SPLK-5001 Cyber Landscape And Industry Frameworks Practice Test 2 — 15 Questions

Question 1

A SOC manager is reviewing their team's detection capabilities against the MITRE ATT&CK framework. They notice a gap in detecting techniques related to 'Credential Access'. Which of the following Splunk ES correlation searches would be most relevant to address this gap?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Detect Credential Dumping via LSASS. Credential Access techniques focus on stealing credentials. Credential dumping via LSASS is a core technique (T1003.001) that directly involves extracting credentials from memory. A correlation search detecting this activity would effectively address a gap in Credential Access detection. While other options like Kerberoasting are also Credential Access, they are more specific, whereas LSASS dumping is a broader and highly prevalent method.

Answer

Detect Kerberoasting

Answer

Detect Pass-the-Hash

Answer

Detect Excessive Failed Logins

Question 2

A security analyst is leveraging the Splunk Enterprise Security 'Threat Intelligence' framework to identify adversaries targeting their organization. They have ingested a STIX/TAXII feed containing indicators of compromise (IOCs) associated with a known APT group. The analyst wants to correlate these IOCs with internal events to identify potential compromises. Which of the following is the most accurate method to achieve this correlation in Splunk ES?

Accepted Answer

Use the 'threat_intel' macro within correlation searches to match IOCs against normalized event data.. The most accurate method to correlate ingested IOCs with internal events in Splunk ES is to use the 'threat_intel' macro within correlation searches. This macro performs lookups against the threat intelligence KV store, enriching events with IOC matches and enabling analysts to detect potential compromises. It leverages the framework's automation and is the intended mechanism for such correlation, ensuring efficiency and accuracy.

Answer

Create a custom search that manually extracts IOCs from the STIX/TAXII feed and uses the 'lookup' command to match against events.

Answer

Configure the 'Threat Intelligence' framework to automatically generate notable events for every IOC match without additional correlation searches.

Answer

Enable the 'Threat Intelligence' data model acceleration and run searches against the 'Threat_Intelligence' data model.

Question 3

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

Accepted Answer

Command and Control (C2).. Strict egress filtering on the firewall blocks outbound connections from compromised hosts to attacker-controlled infrastructure, which directly disrupts the Command and Control (C2) phase of the Cyber Kill Chain. Without C2, the attacker cannot issue commands, exfiltrate data, or maintain persistence, making egress filtering one of the most effective C2 mitigations.

Answer

Installation.

Answer

Reconnaissance.

Answer

Exploitation.

Question 4

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

Accepted Answer

Email gateway logs and web proxy logs.. The Delivery phase of the Cyber Kill Chain covers how the attacker transmits the weaponized payload to the victim — typically via email attachments, malicious links, or drive-by downloads. Email gateway logs capture delivery attempts (attachments, sender reputation, URL clicks), and web proxy logs capture drive-by download and malicious URL access. These two sources are the primary telemetry for correlating alerts to the Delivery stage.

Answer

Domain Controller authentication logs.

Answer

Internal host process creation logs.

Answer

Endpoint file integrity monitoring.

Question 5

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

Accepted Answer

Assets and Identity Data Model.. The Assets and Identity Data Model is the Splunk Common Information Model (CIM) data model that normalizes asset inventory and identity information — hostnames, IPs, MAC addresses, OS details, and user identities. CIS Control 1 (Inventory and Control of Enterprise Assets) requires knowing every device on the network, and this data model is purpose-built to provide that visibility. It is the essential model for tracking enterprise assets in Splunk.

Answer

Vulnerability Data Model.

Answer

Endpoint Data Model.

Answer

Network Traffic Data Model.

Question 6

You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?

Accepted Answer

Splunk App for CIS Benchmarks.. The Splunk App for CIS Benchmarks is the standard tool for ingesting and reporting CIS Benchmark compliance checks in Splunk. It provides pre-built dashboards, reports, and data models specifically for CIS compliance monitoring across various platforms, including Linux.

Answer

Splunk Add-on for Linux Auditd.

Answer

Splunk App for Infrastructure (SAI).

Answer

Splunk Enterprise Security Vulnerability Scanner.

Question 7

Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?

Accepted Answer

Executing code to take advantage of a vulnerability.. The Exploitation phase of the Cyber Kill Chain is when the attacker's weaponized payload triggers the vulnerability and executes code on the victim's system. This is the moment the malicious code runs and takes advantage of a software flaw (e.g., a buffer overflow, deserialization bug, or macro execution). It is distinct from Delivery (transmitting the payload) and Installation (establishing persistence).

Answer

Establishing a persistent connection to the attacker.

Answer

Exfiltrating sensitive company data.

Answer

Gathering information about the target.

Question 8

A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?

Accepted Answer

Email security logs or Web Proxy logs.. MITRE ATT&CK's Initial Access tactic covers techniques like phishing (T1566), exploitation of public-facing applications (T1190), and valid accounts (T1078). Phishing is the most common initial access vector, so email security logs are primary for detecting malicious attachments, links, and sender anomalies. Web proxy logs are also primary because they capture drive-by compromise and access to malicious URLs used in initial access. Together they provide the telemetry needed to investigate Initial Access alerts.

Answer

Local authentication logs.

Answer

Process audit logs.

Answer

Registry modification logs.

Question 9

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

Accepted Answer

The 'Incident Review' dashboard for documenting resolution steps.. The 'Incident Review' dashboard in Splunk Enterprise Security is the built-in workspace where analysts document investigation findings, resolution steps, and post-incident notes tied to notable events. This directly supports the NIST CSF 'Recover' function, which emphasizes restoring capabilities and documenting lessons learned after an incident. Because Incident Review captures the full lifecycle of a notable event — from triage through closure — it is the natural artifact for demonstrating a documented incident response process.

Answer

The 'Data Model Acceleration' settings.

Answer

The 'Threat Intelligence' upload manager.

Answer

The 'Workflow Actions' settings for firewall rule creation.

Question 10

You are tasked with reporting on 'Lateral Movement' (MITRE ATT&CK) using Splunk ES. Which Data Model must be populated and enabled for this report to function correctly?

Accepted Answer

The 'Authentication' Data Model.. Lateral movement in MITRE ATT&CK involves an adversary moving from one host to another, which is detected in Splunk ES primarily through authentication activity — logons, remote service creation, and credential use across systems. The Authentication data model normalizes logon/logoff, privilege escalation, and related events, and ES correlation searches for lateral movement (e.g., 'Detect Lateral Movement' or 'Excessive Authentication Failures') rely on it. Without the Authentication data model populated and accelerated, those detections cannot fire.

Answer

The 'Network Resolution' Data Model.

Answer

The 'Vulnerability' Data Model.

Answer

The 'Malware' Data Model.

Question 11

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

Accepted Answer

Asset and Identity framework using lookup tables.. The Asset and Identity framework in Splunk ES uses lookup tables to maintain authoritative records of assets (hardware, software, systems) and identities (users). For maintaining a current list of authorized software, the asset lookup table can include software inventory fields, and the framework supports scheduled updates from external sources. This aligns with the NIST CSF Identify function's goal of maintaining an inventory of authorized software (ID.AM-2).

Answer

Index-time field extraction.

Answer

Correlation search thresholding.

Answer

Dynamic Threat Intelligence updates.

Question 12

Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?

Accepted Answer

Scanning external IP ranges for open ports.. Reconnaissance in the Cyber Kill Chain involves information gathering and scanning to identify potential targets. Scanning external IP ranges for open ports is a classic reconnaissance activity, as it helps attackers map the attack surface. The other options represent later stages: spear-phishing is delivery, encryption for ransom is actions on objectives, and installing a backdoor is installation.

Answer

Sending a spear-phishing email.

Answer

Encrypting user files for ransom.

Answer

Installing a backdoor on a web server.

Question 13

Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?

Accepted Answer

Detect. The NIST Cybersecurity Framework (CSF) Core defines five concurrent and continuous functions: Identify, Protect, Detect, Respond, and Recover. Option E (Identify) is correct because it covers understanding the organization's assets, risks, and governance to prioritize cybersecurity efforts. Option D (Protect) is correct because it encompasses safeguards such as access control, awareness training, and data security to limit or contain the impact of a potential event. Option C (Detect) is correct because it defines activities to identify the occurrence of a cybersecurity event, including continuous monitoring and anomaly detection. Options A (Report) and B (Eradicate) are not CSF Core functions; they belong to other frameworks or incident-response lifecycles (for example, 'Eradicate' appears in NIST SP 800-61 incident handling, and 'Report' is not one of the five CSF functions).

Answer

Report

Answer

Eradicate

Question 14

You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?

Accepted Answer

Enablement of the 'Splunk App for CIS Benchmarks'.. Option B is correct because the Splunk App for CIS Benchmarks provides the pre-built dashboards, reports, and knowledge objects that map CIS Benchmark controls to Splunk data, which is required to report on Secure Configuration compliance. Option D is correct because the Splunk Universal Forwarder must be deployed on the target endpoints to collect and forward the relevant security configuration data (such as registry, file, and audit settings) to the Splunk indexers for analysis. Option A is incorrect because Splunk can ingest data via multiple protocols (Splunk-to-Splunk, HTTP Event Collector, syslog, etc.), and restricting to syslog only is neither necessary nor sufficient for CIS Benchmark reporting. Option C is incorrect because a third-party antivirus solution is unrelated to Splunk's CIS Benchmark reporting capability. Option E is incorrect because index storage tiering (Hot/Warm) affects retention and performance, not the ability to report on Secure Configuration.

Answer

Configure all logs to use the 'Syslog' protocol only.

Answer

Install a third-party antivirus solution.

Answer

Configure the index to 'Hot/Warm' storage only.

Question 15

Which THREE of the following are common phases defined in the Cyber Kill Chain model?

Accepted Answer

Reconnaissance. The Cyber Kill Chain, developed by Lockheed Martin, defines seven sequential phases of an intrusion: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. Option B (Reconnaissance) is correct because it is the first phase, where the attacker gathers information about the target (e.g., via OSINT, scanning, or social engineering). Option C (Weaponization) is correct because it is the phase where the attacker pairs a remote access trojan or exploit with a deliverable payload (e.g., a malicious document or exploit kit). Option D (Exploitation) is correct because it is the phase where the malicious code is triggered to take advantage of a vulnerability on the target system. Option A (Containment) is not part of the Cyber Kill Chain; it belongs to incident response frameworks such as NIST SP 800-61 (containment, eradication, recovery). Option E (Patching) is not a kill chain phase either; it is a defensive remediation activity, not an attacker phase in the model.

Answer

Containment

Answer

Patching