SPLK-5001 Hard Questions — 25 Difficult Questions

Question 1

You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?

Accepted Answer

Enablement of the 'Splunk App for CIS Benchmarks'.. To report on CIS benchmarks, you need to collect the configuration data and have a mechanism to compare it against the expected state (the benchmark).

Answer

Configure all logs to use the 'Syslog' protocol only.

Answer

Install a third-party antivirus solution.

Answer

Configure the index to 'Hot/Warm' storage only.

Question 2

You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?

Accepted Answer

Notable Events framework.. The 'Notable Events' framework and 'Correlation Searches' are the primary mechanisms in ES for detecting and surfacing security anomalies.

Answer

Workload Management.

Answer

Data Model acceleration.

Answer

Report acceleration.

Question 3

An analyst is investigating an incident where a user's risk score spiked significantly. Which investigative tool allows the analyst to see the timeline of all contributing risk events?

Accepted Answer

Risk Analysis Dashboard. The 'Risk Analysis' dashboard displays a timeline and list of events that contributed to an object's current risk score.

Answer

Security Posture Dashboard

Answer

Investigation Workbench

Answer

Incident Review

Question 4

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

Accepted Answer

Change Analysis. The 'Change Analysis' data model tracks significant system changes, including clearing security logs.

Answer

Endpoint

Answer

Network Traffic

Answer

Authentication

Question 5

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

Accepted Answer

The 'Incident Review' dashboard for documenting resolution steps.. The 'Incident Review' dashboard and the 'Notable Event' workflow actions allow for the documentation and categorization of incident resolution and recovery steps.

Answer

The 'Data Model Acceleration' settings.

Answer

The 'Threat Intelligence' upload manager.

Answer

The 'Workflow Actions' settings for firewall rule creation.

Question 6

You are configuring the Splunk Security Essentials (SSE) app to align with the NIST CSF framework. You want to prioritize your detection development based on the most critical gaps. Which action should you take?

Accepted Answer

Navigate to the 'Compliance' tab and run a report on 'Framework Coverage'.. The 'Content Introspection' or 'Security Content' dashboard in SSE allows users to filter by framework and maturity to identify coverage gaps.

Answer

Manually edit the 'Data Model' accelerations for NIST compliance.

Answer

Modify the 'Notable Event' aggregation policy to NIST standards.

Answer

Update the 'Threat Intelligence' index settings to include NIST tags.

Question 7

You are reviewing a Splunk Enterprise Security alert mapped to the MITRE ATT&CK technique 'T1059.001 (PowerShell)'. Which search command would best identify the use of obfuscated PowerShell commands?

Accepted Answer

tstats count from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe.. The 'tstats' command is the standard way to query data models efficiently, such as the 'Endpoint' model, to look for malicious PowerShell patterns.

Answer

search sourcetype=sysmon | rename command as powershell.

Answer

| inputlookup mitre_tactics | where process=powershell.

Answer

index=main | lookup mitre_attack_id.

Question 8

Which THREE techniques can be used in Splunk to reduce the noise of false positives during a threat hunt?

Accepted Answer

Using 'NOT' clauses to exclude known administrative processes. Filtering known-good values, using lookup tables for exclusions, and weighting alerts are all standard methods for noise reduction.

Answer

Deleting raw logs after indexing

Answer

Increasing the search time range

Question 9

When hunting for lateral movement, which THREE data sources are most valuable for correlation?

Accepted Answer

Windows Security Event ID 4688 (Process Creation). Authentication logs (4624), process execution (4688), and service installation (7045) provide the necessary context to track an attacker moving between hosts.

Answer

Windows System Event ID 104 (Log Cleared)

Answer

Windows Security Event ID 4611 (Trusted Logon)

Question 10

Which THREE elements are essential for a well-defined risk-based alert?

Accepted Answer

A threshold for notable generation. RBA requires identifying the risk object, assigning a score, and using a correlation search to monitor that risk.

Answer

Manual approval for every alert

Answer

Hardware-level encryption

Question 11

Which TWO actions can be taken on a notable event directly from the Incident Review dashboard?

Accepted Answer

Change the notable event status. Analysts can run adaptive response actions and manage the notable event status directly from this dashboard.

Answer

Modify the correlation search code

Answer

Rebuild the threat intelligence index

Answer

Delete the underlying index

Question 12

You are troubleshooting a scenario where the 'Risk Notable' is not firing as expected. Which log file should you inspect first to confirm if the Risk Analysis action was successfully triggered?

Accepted Answer

splunkd.log. The splunkd.log file contains internal diagnostic information about adaptive response actions executed by the correlation search scheduler.

Answer

correlation_search.log

Answer

notable_events.log

Answer

risk_index.log

Question 13

A security engineer is configuring a new correlation search that needs to correlate data across two different indexes. Which Splunk ES feature allows for efficient correlation across large datasets?

Accepted Answer

Data Model Acceleration. Data model acceleration allows Splunk to pre-calculate and store data models, making correlation searches run significantly faster than raw searches across indices.

Answer

Summary Indexing

Answer

Correlation Search Tuning

Answer

Lookup file generation

Question 14

You want to suppress a specific correlation search alert for a legitimate vulnerability scan. What is the most precise way to achieve this without disabling the search?

Accepted Answer

Create a Notable Event Suppression entry.. Notable Event Suppression allows you to define specific filter criteria based on fields like host, user, or signature to ignore known false positives.

Answer

Lower the urgency of the notable event.

Answer

Modify the correlation search cron schedule.

Answer

Delete the scan data from the index.

Question 15

You are creating a custom Adaptive Response action. The action requires a Python script. Where must this script be placed for the Splunk instance to execute it?

Accepted Answer

$SPLUNK_HOME/etc/apps/<app_name>/bin. The script must be placed in the 'bin' directory of the specific Add-on or app directory to be accessible by the Splunk search process.

Answer

The root of the Splunk installation directory.

Answer

/etc/system/bin

Answer

/var/lib/splunk/scripts

Question 16

Which TWO ways can you enrich events with threat intelligence in Splunk ES?

Accepted Answer

Using the 'lookup' command against a KV Store collection.. Threat intel can be added via the 'Threat Intelligence' framework (using KV Store lookups) or by using standard 'lookup' commands against threat feeds.

Answer

By changing the user's password.

Answer

By editing the indexer's configuration files.

Answer

By deleting the old notable events.

Question 17

You are investigating a potential beaconing pattern. You have identified a suspect destination IP. Which SPL command sequence is most appropriate to calculate the frequency of connections to this IP to validate the beaconing hypothesis?

Accepted Answer

search dest_ip=x.x.x.x | streamstats current=f window=2 global=f last(_time) as prev_time | eval diff=_time - prev_time. The streamstats command allows for calculating intervals between events, which is critical for identifying beaconing patterns in network traffic.

Answer

search dest_ip=x.x.x.x | rare dest_ip

Answer

search dest_ip=x.x.x.x | timechart span=1h count

Answer

search dest_ip=x.x.x.x | stats count by _time

Question 18

Which THREE of the following are benefits of using Risk-Based Alerting (RBA) in Splunk ES?

Accepted Answer

Improved focus on behavioral indicators. RBA reduces noise, prioritizes high-risk entities, and focuses on behavioral patterns.

Answer

Automatic remediation of threats

Answer

Automatic license management

Question 19

An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?

Accepted Answer

Endpoint. The Endpoint data model contains the 'process_path' and 'process_name' fields required for this comparison.

Answer

Authentication

Answer

Network Traffic

Answer

Change Analysis

Question 20

Which TWO factors influence an object's final risk score in Splunk ES?

Accepted Answer

Individual risk event scores. The final score is influenced by the individual event scores and the aggregation method applied.

Answer

The number of users in the organization

Answer

The total disk space of the index

Answer

The operating system of the host