SPLK-5001 Investigation And Risk Management — 10 Questions

Question 1

Which field is mandatory for the Risk Analysis adaptive response action to successfully map an event to a user?

Accepted Answer

risk_object. The 'risk_object' field is essential for identifying the entity that the risk is being attributed to.

Answer

signature

Answer

src_ip

Answer

user_id

Question 2

Which field must be present in a notable event for it to be displayed in the 'Incident Review' dashboard?

Accepted Answer

is_notable=1. Notable events are identified by specific fields that Splunk ES uses to map them to the dashboard.

Answer

owner

Answer

incident_id

Answer

risk_score

Question 3

When calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?

Accepted Answer

The scores are additive.. The 'sum' aggregation method cumulatively adds the risk score of every incident to the total score of the object.

Answer

Only the highest score is kept.

Answer

The scores are averaged.

Answer

The risk score is reset to zero.

Question 4

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

Accepted Answer

Correlation Search Editor. Risk rules are often defined within the correlation search itself, where the risk score is mapped to the event severity.

Answer

Identity Manager

Answer

Risk Index Configuration

Answer

Risk Notable Settings

Question 5

During an investigation, you need to group related notables into a single investigation container. Which feature should you use?

Accepted Answer

Splunk Case Management. In Splunk ES, 'Cases' are the primary mechanism for grouping and managing related notable events during an investigation.

Answer

Notable Event Aggregation

Answer

Notable Event Suppression

Answer

Incident Review Filters

Question 6

You are troubleshooting a scenario where the 'Risk Notable' is not firing as expected. Which log file should you inspect first to confirm if the Risk Analysis action was successfully triggered?

Accepted Answer

splunkd.log. The splunkd.log file contains internal diagnostic information about adaptive response actions executed by the correlation search scheduler.

Answer

correlation_search.log

Answer

notable_events.log

Answer

risk_index.log

Question 7

A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?

Accepted Answer

Correlation Search Suppression. Notable event suppression is the native method in Splunk ES to prevent specific event types from triggering notables based on criteria.

Answer

Risk Index Retention Policy

Answer

Data Model Acceleration

Answer

Asset and Identity Table

Question 8

When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?

Accepted Answer

Risk Analysis Dashboard. The Risk Analysis dashboard allows analysts to drill down into the specific risk events contributing to a user's total risk score.

Answer

Threat Activity Dashboard

Answer

Access Anomalies Dashboard

Answer

Incident Review

Question 9

You are configuring a new Risk-Based Alerting (RBA) workflow. Which component is responsible for transforming raw logs into risk notables within the Splunk Enterprise Security app?

Accepted Answer

Risk Analysis Adaptive Response Action. The Risk Analysis adaptive response action is the core mechanism in Splunk ES used to generate risk events from notable events or correlation searches.

Answer

Asset and Identity Framework

Answer

Correlation Search Editor

Answer

Notable Event Suppression

Question 10

In the context of Splunk ES, what is an 'Asset'?

Accepted Answer

An entity like a host or server.. An asset represents an entity in the environment, such as a host or server, which is stored in the asset and identity framework for context enrichment.

Answer

A malicious IP address.

Answer

A saved search report.

Answer

A notable event.