SPLK-5001 Hard Questions — 25 Difficult Questions

Question 1

If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?

Accepted Answer

Splunk Index Manager interface.. The 'risk' index is a standard Splunk index, so its retention (frozenTimePeriodInSecs) is managed through the Splunk Index Manager interface (Settings > Indexes in Splunk Web, or indexes.conf). ES does not override index retention through its own app settings, so the Index Manager is the correct place to modify retention for the risk index.

Answer

ES app settings.

Answer

Data model acceleration settings.

Answer

Correlation Search Editor.

Question 2

A Splunk ES analyst is tuning a correlation search that generates a large number of false positives. The analyst wants to reduce noise without disabling the search entirely. The search currently uses a risk rule that assigns a risk score of 20 to each matching event. Which approach best aligns with risk-based alerting best practices?

Accepted Answer

Adjust the search's risk rule to assign a lower risk score and add a filter to exclude known benign activity.. Tuning a noisy risk rule should involve refining the detection logic to exclude benign activity and adjusting the risk score to reflect the rule's true severity. This reduces false positives without sacrificing detection coverage. Simply raising the score, throttling, or disabling the search either fails to address the root cause or removes detection capability. The best practice is to iteratively tune the risk rule based on observed false positives.

Answer

Increase the risk score to 100 so that only high-risk events trigger notables.

Answer

Add a throttle to the correlation search to suppress duplicate notable events.

Answer

Disable the correlation search and create a new one with a different name.

Question 3

You are troubleshooting why a specific Correlation Search is not appearing in the Incident Review dashboard despite the search returning results. What is the most likely cause?

Accepted Answer

The 'Notable' adaptive response action is not enabled in the search configuration.. For a correlation search's results to appear in Incident Review, the search must include the 'Notable' adaptive response action in its configuration. Without this action enabled, the search runs and returns results, but no notable events are written to the notable index, so Incident Review shows nothing. This is the most common cause of 'search fires but no notables appear.'

Answer

The correlation search schedule is set to 'Real-time'.

Answer

The user does not have the 'ess_admin' role.

Answer

The data model acceleration is lagging.

Question 4

What is the purpose of the 'map' command in complex searches?

Accepted Answer

Runs a subsearch for each event in the results.. The map command in Splunk is a streaming subsearch command that iterates over each result row and runs a specified subsearch once per row, injecting the current row's field values into the subsearch. It is used to enrich or correlate events by executing a nested search for every event returned by the outer search. This makes it fundamentally a per-event subsearch executor, not a geolocation or visualization tool.

Answer

Maps IP addresses to locations.

Answer

Maps fields to a dashboard.

Answer

Creates a map visualization.

Question 5

You are hunting for beaconing activity in proxy logs ingested into Splunk, where an implant contacts its command-and-control server at regular intervals with small jitter. Which analytic approach best identifies a host exhibiting this periodic communication pattern?

Accepted Answer

Compute the standard deviation or variance of the inter-arrival times between successive connections from each host to each destination, then flag destinations with low variance and regular spacing.. Periodic command-and-control check-ins reveal themselves through the regularity of connection timing rather than through volume. Calculating the variance of inter-arrival times between a host and each destination, then flagging pairs with low variance and consistent spacing, isolates beacon-like behavior even when jitter is present, because the underlying cadence remains far more regular than human or application traffic.

Answer

Aggregate bytes transferred per destination and alert when a single destination exceeds a fixed threshold of total data volume per hour.

Answer

Search for any destination whose fully qualified domain name was registered within the last 30 days using a passive DNS lookup and alert on all contacts to it.

Answer

Count total outbound connections per source host per day and alert on any host in the top decile of connection volume.

Question 6

A Splunk ES analyst is reviewing an incident where an attacker used a compromised user account to move laterally within the network. The analyst wants to map this activity to the MITRE ATT&CK framework. Which tactic best describes the attacker's actions?

Accepted Answer

Lateral Movement. The MITRE ATT&CK tactic Lateral Movement describes techniques used by attackers to move through a network after gaining initial access. Using a compromised user account to access other systems is a primary example of this tactic. It allows attackers to expand their foothold, access additional resources, and potentially escalate privileges. Therefore, Lateral Movement is the correct mapping for this activity.

Answer

Initial Access

Answer

Privilege Escalation

Answer

Execution

Question 7

Which THREE elements are essential for a well-defined risk-based alert?

Accepted Answer

A threshold for notable generation. A well-defined risk-based alert requires a threshold for notable generation (A), because the detection logic must specify the exact condition or value at which an event becomes notable enough to trigger an alert, avoiding noise from insignificant activity. It also requires assignment of a risk score (B), since the risk-based approach quantifies the severity or likelihood of the identified risk so alerts can be prioritized and correlated. Identification of a risk object (D) is essential because the alert must name the specific entity at risk, such as a user, host, IP address, or asset, so analysts know what is being evaluated and can respond appropriately. Manual approval for every alert (C) is not essential and would defeat the purpose of automated risk-based detection by creating an unscalable bottleneck. Hardware-level encryption (E) is unrelated to defining an alert; it is a data-protection control, not a component of alert logic or risk scoring.

Answer

Manual approval for every alert

Answer

Hardware-level encryption

Question 8

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

Accepted Answer

The 'Incident Review' dashboard for documenting resolution steps.. The 'Incident Review' dashboard in Splunk Enterprise Security is the built-in workspace where analysts document investigation findings, resolution steps, and post-incident notes tied to notable events. This directly supports the NIST CSF 'Recover' function, which emphasizes restoring capabilities and documenting lessons learned after an incident. Because Incident Review captures the full lifecycle of a notable event — from triage through closure — it is the natural artifact for demonstrating a documented incident response process.

Answer

The 'Data Model Acceleration' settings.

Answer

The 'Threat Intelligence' upload manager.

Answer

The 'Workflow Actions' settings for firewall rule creation.

Question 9

Which THREE diagnostic tools or logs are useful for troubleshooting a malfunctioning correlation search?

Accepted Answer

The 'notable' index logs.. The 'notable' index logs (A) are useful because correlation searches generate notable events that are written to the notable index, so inspecting it reveals whether the search fired and what it produced. scheduler.log (C) is essential because it records the scheduling of correlation searches, including skipped, deferred, or failed runs and any errors thrown during execution. The Search Job Inspector (E) is useful because it exposes the exact SPL executed, search duration, and detailed execution costs/errors, helping pinpoint why a correlation search misbehaves. The Splunk License usage report (B) only shows indexing volume against license limits and does not diagnose search logic or scheduling failures, and the user's web browser cache (D) is a client-side artifact unrelated to server-side correlation search execution.

Answer

The Splunk License usage report.

Answer

The user's web browser cache.

Question 10

An analyst needs to review firewall traffic but only for events where the action field is explicitly 'blocked' and the bytes_out field is greater than 5000. Some events are missing the action field entirely. Which SPL search returns only events that satisfy both conditions?

Accepted Answer

index=firewall action=blocked bytes_out>5000. In SPL, multiple search terms typed into the base search are implicitly combined with AND logic. Writing action=blocked bytes_out>5000 therefore requires both field conditions to be true for an event to be returned. Because events missing the action field cannot satisfy action=blocked, they are silently dropped, which matches the requirement to review only complete, explicitly blocked high-volume traffic.

Answer

index=firewall action=blocked OR bytes_out>5000

Answer

index=firewall action=blocked NOT bytes_out>5000

Answer

index=firewall action=blocked bytes_out<5000

Question 11

Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?

Accepted Answer

Risk Message. In the Risk Analysis adaptive response action, the Risk Object (D) specifies which entity type the risk is applied to, such as a user, host, or IP address, making it a required configurable field. The Risk Score (C) sets the numeric risk value (typically 0–100) that the action assigns to that object, which is the core purpose of the action. The Risk Message (B) provides a descriptive text string explaining why the risk was assigned, and it is also configurable within the action. CPU core count (A) and network interface speed (E) are hardware/resource parameters unrelated to risk analysis and cannot be set in this adaptive response action.

Answer

CPU core count

Answer

Network interface speed

Question 12

You notice a high volume of traffic from an internal workstation to a non-standard port on an external server. Which search helps identify the frequency of this connection?

Accepted Answer

tstats. tstats is the correct choice because it queries accelerated data model summaries rather than raw events, delivering dramatically faster results for high-volume statistical searches like counting connections to a specific external port. For a hunt involving a high volume of traffic, tstats with a data model such as Network_Traffic or Web can return frequency counts in seconds where a raw search would take minutes. This performance advantage is exactly why tstats is the recommended tool for repetitive, high-cardinality hunting queries.

Answer

inputlookup

Answer

map

Answer

search

Question 13

An attacker has modified the registry to ensure persistence. Which Splunk ES data model tracks Windows registry changes?

Accepted Answer

Change Analysis. The Change Analysis data model in Splunk ES tracks changes to system configurations, including Windows registry modifications, file integrity changes, and endpoint configuration changes. It is specifically designed to detect persistence mechanisms and unauthorized system changes. The Endpoint data model covers process and file activity but not registry change tracking in the same way.

Answer

Web

Answer

Endpoint

Answer

Authentication

Question 14

When configuring the 'Risk Analysis' adaptive response, what does the 'risk_score' parameter represent?

Accepted Answer

The value added to the object's risk score.. In the Risk Analysis adaptive response, the 'risk_score' parameter specifies the numeric value that will be added to the risk score of the object (user, system, or other entity) associated with the notable event. It is the incremental contribution of that specific risk event, not the object's total score or a threshold.

Answer

The severity level of the notable event.

Answer

The threshold for triggering a notable.

Answer

The total risk score for the object.

Question 15

A SOC manager is aligning Splunk Enterprise Security with the NIST Cybersecurity Framework. They need to ensure that the 'Respond' function is properly supported. Which Splunk ES feature is specifically designed to facilitate the 'Respond' function by automating actions such as blocking IPs or disabling users?

Accepted Answer

Adaptive Response. Adaptive Response is the Splunk ES feature that directly supports the NIST CSF Respond function by enabling automated and manual actions on notable events. It allows analysts to execute scripts, block IPs, disable users, and more, thereby containing threats rapidly. This aligns with the Respond function's objectives of containment, mitigation, and improvement.

Answer

Incident Review

Answer

Threat Intelligence Framework

Answer

Risk Analysis

Question 16

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

Accepted Answer

Change Analysis. The Change Analysis data model in Splunk ES tracks changes to system configurations, including audit log clears and service changes. Clearing the Windows Security Event log generates Event ID 1102 (or 104 for older systems), which the Change Analysis data model captures as a change event, making it the correct detection source.

Answer

Endpoint

Answer

Network Traffic

Answer

Authentication

Question 17

An analyst is investigating a suspected credential dumping attack on a Windows host. They want to identify evidence of this activity in Splunk ES. Which TWO of the following are valid indicators of credential dumping that can be found in Splunk ES data? (Choose two.)

Accepted Answer

Presence of a file named “lsass.dmp” in a temp directory. Credential dumping involves extracting credentials from memory or files. Access to lsass.exe with suspicious access rights indicates an attempt to read its memory, where credentials are stored. The creation of a file named lsass.dmp is a direct artifact of dumping the lsass process memory. Both indicators are observable in Splunk ES via endpoint data models and are strong evidence of credential dumping activity.

Answer

Anomalous number of failed logon attempts

Answer

Creation of a new service with a random name

Answer

Unexpected modification of the hosts file

Question 18

During an investigation, an analyst needs to correlate a series of authentication failures with subsequent successful logins from the same source across multiple indexers. Which Splunk Enterprise Security capability is most appropriate for this task?

Accepted Answer

The Authentication data model, which normalizes authentication events and supports pivoting across users, sources, and outcomes.. The Authentication data model normalizes authentication events from diverse sources into a consistent schema with fields for user, source, action, and outcome. This allows analysts to correlate failed and successful authentications from the same source across multiple indexers. It is purpose-built for authentication investigations, unlike network, risk, or web data models that serve different analytic needs.

Answer

The Network Traffic data model, which captures sessions and can reveal authentication attempts embedded in network flows.

Answer

The Risk data model, which aggregates risk events and can show whether authentication failures contributed to an entity's score.

Answer

The Web data model, which captures HTTP activity and can include login attempts to web applications.

Question 19

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

Accepted Answer

Asset and Identity framework using lookup tables.. The Asset and Identity framework in Splunk ES uses lookup tables to maintain authoritative records of assets (hardware, software, systems) and identities (users). For maintaining a current list of authorized software, the asset lookup table can include software inventory fields, and the framework supports scheduled updates from external sources. This aligns with the NIST CSF Identify function's goal of maintaining an inventory of authorized software (ID.AM-2).

Answer

Index-time field extraction.

Answer

Correlation search thresholding.

Answer

Dynamic Threat Intelligence updates.

Question 20

You are hunting for DNS-based data exfiltration using Splunk, where malware encodes stolen data in subdomain labels of queries to an attacker-controlled domain. Which two search constructs most directly help you quantify abnormally long or high-entropy query names and identify the destination domain being abused? (Choose two.)

Accepted Answer

Use rex to extract the query name into a field, then apply eval len() on the query and stats avg(len) by query to find unusually long names.. DNS exfiltration hides data in the length and variability of subdomain labels, so the strongest hunting constructs extract the query name and quantify its length and the number of unique subdomains per parent domain. Ranking parent domains by these metrics exposes the destination being abused and separates tunneling from ordinary resolution traffic without depending on pre-existing threat intelligence.

Answer

Use the lookup command with a threat intelligence feed of known malicious IP addresses and drop every DNS event whose source is not in the feed.

Answer

Use the dedup command on the query field to remove repeated queries and then count the remaining events per host to determine exfiltration volume.

Answer

Use the transaction command to group all DNS events from a single source IP over a 30-minute window into one event and inspect the raw payload.