SPLK-5001 Cyber Landscape And Industry Frameworks Practice Test 3 — 15 Questions

Question 1

Which THREE of the following represent the categories of threat intelligence that can be managed within the Splunk Enterprise Security 'Threat Intelligence' framework?

Accepted Answer

Domain Names. The Splunk Enterprise Security Threat Intelligence framework organizes indicators into specific intelligence types that can be uploaded, matched against events, and used in correlation searches. Option B (Domain Names) is correct because domain indicators are a supported threat intelligence type, typically stored in the 'domains' intelligence type and used to detect DNS-based malicious activity. Option D (IP Addresses) is correct because IP addresses are a core supported type, stored as the 'ip_intel' intelligence type and used to match network traffic against known malicious hosts. Option E (File Hashes) is correct because file hash indicators (such as MD5, SHA-1, and SHA-256) are supported as the 'file_intel' intelligence type for detecting known malicious files. Option A (User Session Tokens) is not a threat intelligence category in the framework; session tokens are authentication artifacts, not indicators of compromise. Option C (Network Topology Maps) is not a threat intelligence category either; topology maps are network documentation, not actionable threat indicators.

Answer

User Session Tokens

Answer

Network Topology Maps

Question 2

You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?

Accepted Answer

Notable Events framework.. The NIST CSF 'Detect' function requires capabilities to identify the occurrence of cybersecurity events, and in Splunk ES the Notable Events framework (A) is the mechanism that surfaces and tracks those identified events as discrete, reviewable notables for analysts, directly supporting detection visibility. Correlation Searches (D) are the scheduled or real-time detections that evaluate data against rules and generate those notable events, making them the core detection logic that fulfills the Detect function. Workload Management (B) is a resource-scheduling and CPU/IO prioritization feature, not a detection-visibility capability. Data Model acceleration (C) and Report acceleration (E) are performance optimizations that speed up searches over data models or saved reports, but they do not themselves provide detection visibility or generate security findings.

Answer

Workload Management.

Answer

Data Model acceleration.

Answer

Report acceleration.

Question 3

A security team at a financial institution is aligning its detection capabilities with the MITRE ATT&CK framework. They want to identify techniques related to the 'Credential Access' tactic. Which TWO of the following are MITRE ATT&CK techniques that belong to the Credential Access tactic? (Choose two.)

Accepted Answer

Brute Force. The MITRE ATT&CK Credential Access tactic includes techniques such as Brute Force (T1110) and Exploitation for Credential Access (T1212). These techniques are specifically aimed at stealing credentials, such as account names and passwords. Spearphishing Attachment, Process Discovery, and Registry Run Keys belong to other tactics like Initial Access, Discovery, and Persistence, respectively.

Answer

Registry Run Keys / Startup Folder

Answer

Spearphishing Attachment

Answer

Process Discovery

Question 4

A security analyst is mapping Splunk ES correlation searches to the MITRE ATT&CK framework. The analyst needs to identify the technique that describes adversaries using legitimate credentials to access accounts, which often enables lateral movement and evasion. Which MITRE ATT&CK technique should the analyst map to?

Accepted Answer

T1078 - Valid Accounts. The scenario describes adversaries leveraging legitimate credentials to access accounts, which is the definition of MITRE ATT&CK technique T1078 Valid Accounts. This technique covers initial access, persistence, privilege escalation, and defense evasion using valid accounts. Mapping to T1078 helps analysts detect anomalous logins and account misuse, aligning with the need to identify credential-based threats in Splunk ES.

Answer

T1110 - Brute Force

Answer

T1059 - Command and Scripting Interpreter

Answer

T1021 - Remote Services

Question 5

A Splunk ES analyst is investigating an alert for a suspicious PowerShell script execution. The alert is mapped to MITRE ATT&CK technique T1059.001 (PowerShell). To gather more context, the analyst wants to search for related events across multiple data sources. Which Splunk ES feature should they use to pivot from the alert to relevant events?

Accepted Answer

Incident Review. Incident Review is the Splunk ES feature that allows analysts to examine notables and pivot to associated events. It provides a drill-down capability to view raw events, asset context, and threat intelligence, enabling comprehensive investigation of an alert. Other features like Threat Intelligence Framework, Asset and Identity Framework, and Protocol Intelligence serve different purposes and do not provide the same pivot functionality.

Answer

Asset and Identity Framework

Answer

Threat Intelligence Framework

Answer

Protocol Intelligence

Question 6

A security team is mapping its Splunk Enterprise Security (ES) detections to the MITRE ATT&CK framework. The team wants to identify all active detections that can detect adversary behavior related to credential dumping. Which Splunk ES feature should they use to view the MITRE ATT&CK techniques and the associated detections?

Accepted Answer

MITRE ATT&CK Dashboard. The MITRE ATT&CK Dashboard in Splunk ES is designed to map detections to adversary techniques. It allows security teams to filter by technique, such as Credential Dumping, and see which correlation searches are enabled and relevant. This directly supports the goal of identifying active detections for credential dumping, unlike other features that focus on threat intelligence, asset management, or incident triage.

Answer

Threat Intelligence Framework

Answer

Asset & Identity Framework

Answer

Incident Review

Question 7

A SOC manager wants to measure the effectiveness of detection coverage against the MITRE ATT&CK framework using Splunk Enterprise Security. The manager needs to visualize which tactics have the most and least coverage based on enabled correlation searches. Which Splunk ES feature should be used to generate this coverage map?

Accepted Answer

MITRE ATT&CK Dashboard. The MITRE ATT&CK Dashboard in Splunk ES is designed to map correlation searches to ATT&CK techniques and display coverage across the matrix. It allows managers to quickly see which tactics and techniques are covered and which are not, enabling informed decisions about detection engineering priorities. This aligns with the goal of measuring detection effectiveness against the framework.

Answer

Risk Analysis Framework

Answer

Threat Intelligence Management

Answer

Asset and Identity Framework

Question 8

You are a security analyst using Splunk Enterprise Security (ES) to map detections to the MITRE ATT&CK framework. Your CISO wants to understand which ATT&CK tactic is most directly addressed by the correlation search that detects suspicious PowerShell execution with encoded commands (T1059.001). Under which ATT&CK tactic should you classify this detection?

Accepted Answer

Execution. The detection of suspicious PowerShell execution with encoded commands directly aligns with the Execution tactic, as it signifies adversary-controlled code running on a system. MITRE ATT&CK technique T1059.001 is explicitly categorized under Execution, and Splunk ES uses this mapping to help analysts prioritize and contextualize alerts. Classifying it under other tactics would inaccurately reflect the adversary's current phase.

Answer

Persistence

Answer

Defense Evasion

Answer

Initial Access

Question 9

An analyst is investigating a potential data exfiltration incident and wants to determine the adversary's stage according to the Cyber Kill Chain. The analyst observes large outbound transfers to an unfamiliar external IP address after a period of internal reconnaissance. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Actions on Objectives. The Cyber Kill Chain phase Actions on Objectives encompasses the adversary's ultimate goal, which often includes data exfiltration. The large outbound transfers to an unfamiliar external IP after reconnaissance strongly indicate that the adversary is now stealing data. Recognizing this phase helps analysts prioritize containment and recovery efforts, as the breach has progressed to its final stage.

Answer

Exploitation

Answer

Installation

Answer

Command and Control

Question 10

A security team is mapping their Splunk Enterprise Security detections to the MITRE ATT&CK framework. They want to identify techniques that adversaries use to maintain persistent access on compromised endpoints. Which MITRE ATT&CK tactic should they focus on first?

Accepted Answer

Persistence. Persistence is the correct tactic because it directly addresses the adversary's goal of maintaining a foothold on a compromised system. Detections such as unauthorized scheduled tasks, new services, or registry run key modifications are classic persistence techniques. Aligning these with the Persistence tactic in Splunk ES ensures accurate ATT&CK coverage reporting and focused threat hunting.

Answer

Defense Evasion

Answer

Credential Access

Answer

Privilege Escalation

Question 11

A security analyst is reviewing an incident where an attacker used the technique 'T1071.001 - Application Layer Protocol: Web Protocols' for command and control. The analyst needs to identify which data sources in Splunk ES would be most effective for detecting this activity. Which of the following data sources should be prioritized?

Accepted Answer

Web proxy logs and DNS logs. Web proxy logs and DNS logs provide the application-layer visibility needed to detect T1071.001, which relies on HTTP/HTTPS for command and control. Proxy logs show the actual web requests, including URLs and user agents, while DNS logs can reveal domain resolutions to known C2 infrastructure. Splunk ES can ingest these sources and apply threat intelligence matching or behavioral analytics to identify malicious web traffic.

Answer

Firewall logs and NetFlow data

Answer

Endpoint detection and response (EDR) telemetry

Answer

Authentication logs and Windows Security event logs

Question 12

A security team is aligning its Splunk ES deployment with the NIST Cybersecurity Framework. The team wants to ensure that they can effectively respond to detected incidents by executing predefined procedures. Which NIST CSF function and category should they focus on to achieve this?

Accepted Answer

Respond (RS) - Response Planning (RS.RP). The NIST CSF Respond function includes Response Planning, which ensures that response processes and procedures are executed and maintained. This category is directly aimed at enabling organizations to respond effectively to detected cybersecurity incidents. By focusing on RS.RP, the team can establish, test, and improve their incident response plans, aligning with their goal of executing predefined procedures.

Answer

Identify (ID) - Business Environment (ID.BE)

Answer

Recover (RC) - Recovery Planning (RC.RP)

Answer

Detect (DE) - Detection Processes (DE.DP)

Question 13

An analyst is using Splunk Enterprise Security to investigate a potential data exfiltration event. They need to determine which MITRE ATT&CK tactic describes the adversary's objective of stealing data from the compromised network. Which tactic should they reference?

Accepted Answer

Exfiltration. Exfiltration is the correct ATT&CK tactic for data theft. It encompasses techniques like exfiltration over C2 channel, exfiltration over alternative protocol, and exfiltration over physical medium. In Splunk ES, analysts should look for correlation searches that detect anomalous outbound data volumes or connections to known malicious IPs, and ensure these are tagged with the Exfiltration tactic for accurate reporting.

Answer

Collection

Answer

Impact

Answer

Command and Control

Question 14

A security analyst is reviewing the Cyber Kill Chain phases and wants to map Splunk ES detections to the "Command and Control" phase. Which of the following data sources would be most relevant for detecting command and control communications?

Accepted Answer

Firewall logs. Command and Control (C2) communications involve compromised hosts communicating with attacker-controlled infrastructure. Firewall logs provide visibility into network connections, including outbound traffic, which is essential for detecting C2 channels. By analyzing firewall logs for suspicious destinations, unusual ports, or beaconing behavior, analysts can identify C2 activity. Other data sources like endpoint or authentication logs may provide context but are not as directly relevant for network-based C2 detection.

Answer

Endpoint process execution logs

Answer

Authentication logs

Answer

Email gateway logs

Question 15

A Splunk security analyst is mapping the organization's detection capabilities to the NIST Cybersecurity Framework (CSF) Core functions. The analyst wants to ensure that the team can effectively identify anomalous activity across the enterprise. Which CSF function should the analyst prioritize to meet this objective?

Accepted Answer

Detect. The NIST CSF Detect function is specifically designed to identify the occurrence of cybersecurity events through continuous monitoring and anomaly detection. To ensure the team can effectively identify anomalous activity, the analyst should prioritize the Detect function, which encompasses detection processes and technologies like Splunk ES. This function provides the necessary capabilities to discover threats in a timely manner.

Answer

Respond

Answer

Protect

Answer

Identify