SPLK-5001 Cyber Landscape And Industry Frameworks — Timed 15 Questions

Question 1

You are reviewing a Splunk Enterprise Security alert mapped to the MITRE ATT&CK technique 'T1059.001 (PowerShell)'. Which search command would best identify the use of obfuscated PowerShell commands?

Accepted Answer

tstats count from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe.. The `tstats` command efficiently queries data models, and the Endpoint.Processes data model contains process execution events. Filtering for `process_name=powershell.exe` identifies PowerShell usage. To detect obfuscation, additional analysis of command-line arguments is needed, but this search provides the base events for such analysis. It is the most efficient and accurate starting point.

Answer

search sourcetype=sysmon | rename command as powershell.

Answer

| inputlookup mitre_tactics | where process=powershell.

Answer

index=main | lookup mitre_attack_id.

Question 2

You are configuring the Splunk Security Essentials (SSE) app to align with the NIST CSF framework. You want to prioritize your detection development based on the most critical gaps. Which action should you take?

Accepted Answer

Navigate to the 'Compliance' tab and run a report on 'Framework Coverage'.. Splunk Security Essentials (SSE) includes a Compliance tab that maps its detection content to frameworks like NIST CSF, CIS, and MITRE ATT&CK, and the Framework Coverage report shows which controls are covered and which have gaps. Running this report lets you prioritize detection development against the most critical uncovered controls. This is the intended workflow for aligning SSE content with NIST CSF.

Answer

Manually edit the 'Data Model' accelerations for NIST compliance.

Answer

Modify the 'Notable Event' aggregation policy to NIST standards.

Answer

Update the 'Threat Intelligence' index settings to include NIST tags.

Question 3

You are mapping incoming alerts to the MITRE ATT&CK framework within the Splunk Enterprise Security (ES) Incident Review dashboard. Which attribute mapping ensures that your TTP-based notable events correctly reflect the adversary behavior?

Accepted Answer

Utilizing the 'mitre_attack_id' field within the Threat Intelligence framework.. Splunk Enterprise Security maps notables to MITRE ATT&CK using the mitre_attack_id field, which is populated through the Threat Intelligence framework and the ES Threat Activity data model. This field carries the technique ID (e.g., T1059) that links a notable event to the correct adversary technique in the ATT&CK matrix, ensuring the Incident Review dashboard reflects actual TTPs.

Answer

Hardcoding the technique description into the 'dest_host' field.

Answer

Configuring the 'correlation_rule_id' to match the ATT&CK tactic name.

Answer

Mapping the source IP to the 'mitre_source_id' field.

Question 4

When using the Splunk Enterprise Security 'Threat Intelligence' framework, which file type is used to import custom STIX/TAXII threat feeds to align with the MITRE ATT&CK framework?

Accepted Answer

A KV Store collection configured via the 'Threat Intelligence Manager'.. The Splunk Enterprise Security Threat Intelligence framework uses a KV Store collection to store and manage threat intelligence data, including custom STIX/TAXII feeds. The Threat Intelligence Manager is the UI component that allows analysts to upload, configure, and maintain these feeds, which are then stored in the KV Store for correlation and enrichment. This approach enables dynamic updates and integration with the MITRE ATT&CK framework through the Threat Intelligence framework's data models and lookups.

Answer

An XML-based 'Incident Review' dashboard export.

Answer

A custom .yml file uploaded to the /etc/system/local directory.

Answer

A static .conf file in the app bin folder.

Question 5

You are configuring Splunk Enterprise Security to monitor for MITRE ATT&CK 'Persistence' techniques. Which TWO data sources provide the highest fidelity logs for detecting registry-based persistence?

Accepted Answer

Sysmon Event IDs 12 and 13.. Sysmon Event IDs 12 and 13 are correct because Event ID 12 logs registry key create/delete operations and Event ID 13 logs registry value set operations, which directly capture the registry modifications attackers use for persistence (e.g., Run keys, Services, IFEO). Windows Registry audit logs (via GPO/Sysmon) are also correct because enabling registry auditing through GPO or Sysmon provides granular, high-fidelity visibility into registry key and value changes tied to persistence mechanisms. Together these sources record the exact registry artifacts (key paths, value names, data, and process context) needed to detect and investigate registry-based persistence. Windows Security Event Logs (4688) only record process creation and lack registry modification detail, so they are insufficient alone. DNS query logs and Netflow logs capture network activity, not local registry changes, and therefore have no fidelity for registry-based persistence detection.

Answer

Windows Security Event Logs (specifically 4688).

Answer

DNS query logs.

Answer

Netflow logs.

Question 6

You are a SOC analyst at a healthcare provider that must satisfy HIPAA breach-notification timelines. During an investigation in Splunk Enterprise Security, you need to determine the elapsed time between the first suspicious authentication event and the moment the incident was classified as a confirmed breach. Which Splunk ES field should you rely on to calculate that elapsed time accurately?

Accepted Answer

The `detect_time` of the notable event compared with the timestamp recorded when the analyst set the disposition to a breach-confirming value.. HIPAA breach clocks depend on when an incident is confirmed as reportable, so the measurement must anchor on a human confirmation action. The notable event's detection timestamp marks when the system flagged activity, and the disposition change records the analyst's confirming decision. Together they produce an auditable elapsed interval. Fields tied to ticket closure, aggregation windows, or default statuses describe other lifecycle moments and cannot represent confirmation time.

Answer

The `_time` value of the notable event's initial triggering event combined with the `status` field transition to "Closed" on the investigation timeline.

Answer

The `create_time` of the investigation record and the `status` field value "New" on the notable event.

Answer

The `firstTime` and `lastTime` fields on the correlated notable event in the Incident Review dashboard.

Question 7

A security analyst is reviewing an alert generated by Splunk Enterprise Security. The alert details indicate that a user's workstation executed a suspicious PowerShell script shortly after opening a malicious document. The analyst wants to determine the next likely phase of the attack according to the Lockheed Martin Cyber Kill Chain. Which phase should the analyst focus on investigating next?

Accepted Answer

Installation. The scenario describes the execution of a PowerShell script after a user opened a malicious document, which is a classic indicator of the Installation phase in the Cyber Kill Chain. During Installation, attackers install malware or backdoors to maintain persistence. This phase follows Exploitation and precedes Command and Control. The analyst should focus on detecting installation activities, such as new services, scheduled tasks, or registry modifications, to contain the threat.

Answer

Weaponization

Answer

Actions on Objectives

Answer

Command and Control

Question 8

A Splunk ES analyst is mapping detection use cases to the Cyber Kill Chain. They want to prioritize data sources for detecting the 'Command and Control' phase. Which data source is most critical for identifying C2 communications?

Accepted Answer

Proxy logs. Proxy logs are the most critical data source for detecting Command and Control communications because they capture web traffic details such as URLs, user agents, and request patterns. C2 often uses HTTP/HTTPS to blend in, and proxy logs can reveal beaconing, unusual user agents, and connections to known malicious domains. While firewall, endpoint, and DNS logs provide valuable context, proxy logs offer the richest application-layer visibility.

Answer

DNS logs

Answer

Endpoint logs

Answer

Firewall logs

Question 9

A Splunk ES analyst is investigating an alert for suspicious PowerShell execution. The alert is mapped to MITRE ATT&CK technique T1059.001. The analyst wants to quickly determine if the PowerShell command line contains encoded commands, which are often used by attackers to obfuscate malicious scripts. Which Splunk search command should the analyst use to extract and decode the Base64-encoded command from the `CommandLine` field?

Accepted Answer

base64decode. To decode a Base64-encoded PowerShell command, the analyst should use the `base64decode` function within an `eval` command. This function is specifically designed to decode Base64 strings. The analyst would first extract the encoded portion using `rex` or similar, then apply `base64decode` to reveal the original command. This approach efficiently uncovers obfuscated malicious scripts, aiding in incident investigation.

Answer

rex

Answer

eval

Answer

urldecode

Question 10

A security analyst is mapping Splunk ES detections to the Cyber Kill Chain. The analyst has an alert for a suspicious email attachment that executed a malicious macro. Which phase of the Cyber Kill Chain does this activity represent?

Accepted Answer

Installation. The execution of a malicious macro after delivery and user interaction represents the Installation phase of the Cyber Kill Chain, as it often results in the installation of malware or a backdoor. This phase is critical because it establishes the attacker's presence on the system. Splunk ES can detect this through endpoint logs showing process creation, file writes, or registry modifications associated with macro execution.

Answer

Command and Control

Answer

Exploitation

Answer

Delivery

Question 11

An analyst is using Splunk Enterprise Security to investigate a security incident and wants to leverage the Cyber Kill Chain framework to understand the adversary's progression. The analyst needs to identify which data sources are most relevant for detecting the 'Weaponization' and 'Delivery' phases. (Choose two.)

Accepted Answer

Email gateway logs. Email gateway logs and web proxy logs are the most relevant data sources for detecting the Delivery phase, as they capture the methods by which malicious payloads reach the target, such as phishing emails and drive-by downloads. The Weaponization phase occurs on the adversary's infrastructure and is not directly observable in most enterprise logs, so detection focuses on Delivery. These two sources provide visibility into the initial attack vector.

Answer

Firewall logs

Answer

Endpoint detection and response (EDR) logs

Answer

DNS logs

Question 12

A security analyst is using Splunk Enterprise Security to investigate an alert mapped to the MITRE ATT&CK technique 'T1071 Application Layer Protocol'. Which TWO data sources would provide the most relevant evidence for this technique? (Choose two.)

Accepted Answer

Web proxy logs. Web proxy logs and endpoint process execution logs are the most relevant data sources for T1071 Application Layer Protocol. Proxy logs reveal the actual application layer communications, while endpoint logs show the processes initiating those connections. Together, they provide a comprehensive view of C2 activity using protocols like HTTP or HTTPS.

Answer

Authentication logs

Answer

Firewall logs

Answer

DNS query logs

Question 13

You are an analyst at a financial institution using Splunk Enterprise Security (ES). Your organization is aligning its threat intelligence program with the MITRE ATT&CK framework. You want to leverage Splunk ES's Threat Intelligence framework to enrich events and detect adversary techniques. Which TWO of the following actions are necessary to effectively map threat intelligence to MITRE ATT&CK techniques within Splunk ES? (Choose two.)

Accepted Answer

Configure the Threat Intelligence framework to ingest STIX/TAXII feeds and map indicators to MITRE ATT&CK technique IDs using the threat intelligence management interface.. To effectively map threat intelligence to MITRE ATT&CK in Splunk ES, you must ingest and map indicators to techniques using the Threat Intelligence framework, and enable the relevant correlation search that leverages those mappings to generate notable events. These two actions ensure that threat intel is not only collected but actively used to detect adversary techniques, aligning with ATT&CK for enhanced detection and response.

Answer

Use the 'threat_intel' macro in correlation searches to automatically enrich events with ATT&CK technique context from the threat intelligence framework.

Answer

Deploy the Splunk Add-on for MITRE ATT&CK to automatically tag all events with technique IDs based on keyword matching.

Answer

Create a custom lookup file that maps every possible ATT&CK technique to a Splunk ES correlation search name and manually update it daily.

Question 14

An analyst is investigating a security incident and needs to determine the adversary's objective based on the MITRE ATT&CK tactic 'Exfiltration'. The analyst has Splunk ES with data from multiple sources. Which of the following data sources would be most useful for detecting data exfiltration over a command and control channel (T1041)?

Accepted Answer

Web proxy logs with full URL and content inspection. T1041 involves exfiltrating data over an existing command and control channel, which is often web-based. Web proxy logs with full URL and content inspection provide the deepest visibility into the actual data being transmitted, allowing analysts to detect and confirm exfiltration. This makes them the most effective data source for this technique in Splunk ES.

Answer

Endpoint detection and response (EDR) process telemetry

Answer

NetFlow data and firewall logs

Answer

DNS logs with query logging

Question 15

A security analyst is investigating a potential data exfiltration incident. They have identified a series of outbound connections to an unknown external IP address from a server that typically only communicates internally. The analyst wants to determine if this activity aligns with a specific stage of the Cyber Kill Chain. Which stage is most likely represented by these outbound connections?

Accepted Answer

Actions on Objectives. The Cyber Kill Chain's final stage, Actions on Objectives, encompasses the adversary's goals, including data exfiltration. The unexpected outbound connections from a server that typically communicates internally suggest data is being sent externally, aligning with exfiltration as an objective. While Exfiltration is a specific action, it is not a separate stage in the Cyber Kill Chain; it falls under Actions on Objectives.

Answer

Command and Control (C2)

Answer

Exfiltration

Answer

Exploitation