SPLK-5001 Investigation And Risk Management — All Questions With Answers

Question 1easymultiple choice

Read the full Investigation And Risk Management explanation →

Which field is mandatory for the Risk Analysis adaptive response action to successfully map an event to a user?

Question 2hardmultiple choice

Read the full Investigation And Risk Management explanation →

You are troubleshooting a scenario where the 'Risk Notable' is not firing as expected. Which log file should you inspect first to confirm if the Risk Analysis action was successfully triggered?

Question 3easymultiple choice

Read the full Investigation And Risk Management explanation →

You are configuring a new Risk-Based Alerting (RBA) workflow. Which component is responsible for transforming raw logs into risk notables within the Splunk Enterprise Security app?

Question 4mediummultiple choice

Read the full Investigation And Risk Management explanation →

Which field must be present in a notable event for it to be displayed in the 'Incident Review' dashboard?

Question 5mediummultiple choice

Read the full Investigation And Risk Management explanation →

If an analyst wants to see all risk events associated with a specific IP address, which search command is most effective?

Question 6hardmulti select

Read the full Investigation And Risk Management explanation →

Which THREE elements are essential for a well-defined risk-based alert?

Question 7mediummulti select

Read the full Investigation And Risk Management explanation →

Which THREE dashboard categories in Splunk ES are most useful for risk-based investigation?

Question 8mediummultiple choice

Read the full Investigation And Risk Management explanation →

A SOC analyst is reviewing a notable event in Splunk Enterprise Security that fired due to a risk-based alert. The analyst wants to quickly pivot from the notable event to the underlying risk events that contributed to the alert. Which action should the analyst take from the notable event's detail view?

Question 9hardmultiple choice

Read the full Investigation And Risk Management explanation →

A fraud analyst is building a risk rule that assigns a risk score of 20 to any user who triggers a "multiple failed logins" detection. The analyst wants the risk score to decay over time so that a user's accumulated risk does not remain elevated indefinitely. Which Splunk Enterprise Security feature should the analyst configure to achieve this?

Question 10hardmultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is investigating a potential insider threat and needs to review all risk events associated with a specific user over the past 30 days. The analyst wants to see the risk score contributions and the rules that generated them. Which search command should the analyst use to retrieve this information from the risk index?

Question 11mediummultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is reviewing a high-severity notable event generated by a correlation search in Splunk Enterprise Security. The analyst wants to document investigative steps, attach supporting evidence, and collaborate with a teammate directly from the notable event. Which Splunk ES feature should the analyst use?

Question 12mediummultiple choice

Read the full Investigation And Risk Management explanation →

A security analyst is reviewing a notable event that was generated by a risk-based alert. The notable's description mentions a risk object of type "user" with the value "jdoe". The analyst wants to see all risk events associated with that user across all time, not just those in the notable's time window. Which search should the analyst run?

Question 13mediummulti select

Read the full Investigation And Risk Management explanation →

A security analyst is reviewing a notable event in Splunk Enterprise Security that was generated by a correlation search. The notable contains an `ip_address` field, a `user` field, and a `signature` field. The analyst wants to pivot from this notable to a prebuilt investigation dashboard that shows all activity related to the involved IP address and user. Which two actions can the analyst take from the notable event to launch the appropriate investigation view? (Choose two.)

Question 14hardmultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is investigating a notable and wants to add a specific event from the search results to an existing case in Splunk Enterprise Security for collaborative tracking. What is the correct procedure to accomplish this?

Question 15mediummultiple choice

Read the full Investigation And Risk Management explanation →

A SOC manager wants to ensure that when a notable is created, the analyst can quickly see the risk score of the associated risk object without running a separate search. Which Splunk ES feature should the manager configure to display this information directly in the notable's detail view?

Question 16hardmulti select

Read the full Investigation And Risk Management explanation →

A security analyst is configuring a new risk rule in Splunk Enterprise Security to detect suspicious PowerShell activity. The analyst wants to ensure the rule contributes to Risk-Based Alerting (RBA) correctly. Which two actions must the analyst take when defining the risk rule? (Choose two.)

Question 17hardmultiple choice

Read the full Investigation And Risk Management explanation →

A Splunk ES analyst is investigating a suspicious login notable. The notable's `user` field is `jdoe`, and the analyst wants to see a chronological list of all risk events for `jdoe` across all risk rules, including the risk rule name and the risk score contributed by each event. Which search provides this view?

Question 18easymultiple choice

Read the full Investigation And Risk Management explanation →

A security analyst in Splunk ES is reviewing a notable event and wants to see the raw event that triggered the correlation search. Which action should the analyst take?

Question 19mediummultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is reviewing a notable that was generated by a risk rule. The notable's risk score is 80, but the analyst wants to understand which specific risk rules contributed to this score. Which Splunk ES component should the analyst use to see the breakdown of risk contributions by rule?

Question 20hardmultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is building an investigation dashboard that should display the top risk entities over the last 24 hours, based on the cumulative risk scores from all risk rules. The dashboard must update in real time as new risk events arrive. Which search should the analyst use as the base query?

Question 21hardmultiple choice

Read the full Investigation And Risk Management explanation →

When calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?

Question 22mediummultiple choice

Read the full Investigation And Risk Management explanation →

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

Question 23mediummultiple choice

Read the full Investigation And Risk Management explanation →

During an investigation, you need to group related notables into a single investigation container. Which feature should you use?

Question 24mediummultiple choice

Read the full Investigation And Risk Management explanation →

A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?

Question 25easymultiple choice

Read the full Investigation And Risk Management explanation →

When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?

Question 26easymultiple choice

Read the full Investigation And Risk Management explanation →

In the context of Splunk ES, what is an 'Asset'?

Question 27mediummultiple choice

Read the full Investigation And Risk Management explanation →

What is the primary function of the 'Risk Notable' correlation search in Splunk ES?

Question 28hardmultiple choice

Read the full Investigation And Risk Management explanation →

When configuring the 'Risk Analysis' adaptive response, what does the 'risk_score' parameter represent?

Question 29hardmultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is investigating an incident where a user's risk score spiked significantly. Which investigative tool allows the analyst to see the timeline of all contributing risk events?

Question 30mediummultiple choice

Read the full Investigation And Risk Management explanation →

An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?

Question 31easymultiple choice

Read the full Investigation And Risk Management explanation →

Which component in Splunk ES is used to manage the lifecycle of an incident, including status updates and assignments?

Question 32mediummultiple choice

Read the full Investigation And Risk Management explanation →

Which data model does the Risk Analysis adaptive response action typically rely upon to enrich events?

Question 33hardmultiple choice

Read the full Investigation And Risk Management explanation →

A correlation search is failing to generate risk events. You check the 'Search Activity' and see that the search is running but returning 0 results. What is the most likely cause?

Question 34easymultiple choice

Read the full Investigation And Risk Management explanation →

What is the benefit of using the Asset and Identity framework in Splunk ES investigations?

Question 35mediummultiple choice

Read the full Investigation And Risk Management explanation →

When investigating a case, where should an analyst document their findings to ensure they are available to other team members?

Question 36hardmultiple choice

Read the full Investigation And Risk Management explanation →

You notice that the risk score for an asset is not decaying. Which configuration controls the risk score lifespan?

Question 37easymultiple choice

Read the full Investigation And Risk Management explanation →

What is the purpose of the 'Investigation Workbench' in Splunk ES?

Question 38easymultiple choice

Read the full Investigation And Risk Management explanation →

Which of the following is a primary benefit of Risk-Based Alerting (RBA) over traditional alerting?

Question 39hardmultiple choice

Read the full Investigation And Risk Management explanation →

When configuring an 'Adaptive Response' action, what does the 'Notable' action type do?

Question 40easymultiple choice

Read the full Investigation And Risk Management explanation →

In the Incident Review dashboard, what does 'Status' represent?

Question 41mediummulti select

Read the full Investigation And Risk Management explanation →

Which THREE features are provided by the Splunk ES Incident Review dashboard?

Question 42mediummultiple choice

Read the full Investigation And Risk Management explanation →

When reviewing an incident, how can an analyst verify if the notable event was generated by a specific correlation search?

Question 43easymulti select

Read the full Investigation And Risk Management explanation →

Which THREE pieces of information are commonly found in a Splunk ES Case?

Question 44mediummulti select

Read the full Investigation And Risk Management explanation →

Which TWO methods can be used to suppress unwanted notable events?

Question 45hardmultiple choice

Read the full Investigation And Risk Management explanation →

If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?

Question 46easymulti select

Read the full Investigation And Risk Management explanation →

Which TWO of the following are key components of a successful incident investigation workflow in Splunk ES?

Question 47hardmulti select

Read the full Investigation And Risk Management explanation →

Which TWO actions can be taken on a notable event directly from the Incident Review dashboard?

Question 48easymulti select

Read the full Investigation And Risk Management explanation →

Which TWO types of data are commonly enriched by the Asset and Identity framework?

Question 49hardmulti select

Read the full Investigation And Risk Management explanation →

Which TWO factors influence an object's final risk score in Splunk ES?

Question 50easymulti select

Read the full Investigation And Risk Management explanation →

Which THREE actions are part of the 'Incident Review' investigation workflow?

Question 51mediummulti select

Read the full Investigation And Risk Management explanation →

Which TWO metrics are tracked in the 'Incident Review' dashboard's 'Notable Event' list?

Question 52hardmulti select

Read the full Investigation And Risk Management explanation →

Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?

Question 53easymulti select

Read the full Investigation And Risk Management explanation →

Which TWO areas of the Splunk ES environment are used to manage risk-based alerting configurations?

Question 54mediummultiple choice

Read the full Investigation And Risk Management explanation →

A SOC analyst is reviewing a notable event in Splunk Enterprise Security that was generated from a correlation search firing against a risk index. The analyst wants to see the individual risk events that contributed to the notable's risk score, including the contributing risk rules and their individual risk scores. Which action should the analyst take?

Question 55mediummultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is reviewing a notables queue in Splunk Enterprise Security and wants to understand why a particular correlation search generated a high-severity finding. The analyst opens the finding in Incident Review and notices the severity is set to 'high', but the contributing risk score is only 40. Which component of the correlation search configuration most directly determines the severity displayed on the finding?

Question 56hardmultiple choice

Read the full Investigation And Risk Management explanation →

A SOC analyst is building a risk-based alerting workflow and wants to ensure that a specific risk rule only contributes to an entity's risk score when the entity is a user account, not a system or IP address. Which configuration in the risk rule's search definition accomplishes this?

Question 57easymultiple choice

Read the full Investigation And Risk Management explanation →

A security analyst receives a notable event about suspicious PowerShell execution on a workstation. To gather more context, the analyst wants to see all events related to the involved host from the last 24 hours in a single view. Which Splunk ES feature provides this consolidated timeline of activity for an entity?

Question 58mediummultiple choice

Read the full Investigation And Risk Management explanation →

A SOC analyst is reviewing a notable event for a suspected compromised host. The analyst wants to enrich the investigation by viewing the raw event that triggered the detection, along with the associated risk events and threat intelligence matches, directly from the notable event in Splunk Enterprise Security. Which feature should the analyst use to access this consolidated context?

Question 59hardmultiple choice

Read the full Investigation And Risk Management explanation →

A risk analyst notices that a particular risk rule is generating an excessive number of risk events for low-severity activities, causing alert fatigue. The analyst wants to reduce the impact of this rule on overall risk scores without disabling it entirely. What is the most appropriate action?

Question 60mediummulti select

Read the full Investigation And Risk Management explanation →

A SOC manager is defining a new risk-based alerting strategy and wants to ensure that risk events generated by correlation searches are properly attributed and actionable. Which TWO fields are required in a risk event for the Risk Analysis framework to correctly associate risk with an entity and contribute to its score? (Choose two.)

Question 61mediummulti select

Read the full Investigation And Risk Management explanation →

A security analyst is documenting the key phases of a Splunk Enterprise Security investigation workflow for a new team member. Which two phases are essential components of this workflow? (Choose two.)

Question 62easymultiple choice

Read the full Investigation And Risk Management explanation →

A junior analyst is asked to find all risk events associated with a specific user account to assess potential insider threat activity. Which search command should the analyst use to retrieve these risk events from the risk index?

Question 63mediummultiple choice

Read the full Investigation And Risk Management explanation →

A SOC analyst is reviewing a notables list in Splunk Enterprise Security and wants to see the individual risk events that contributed to a specific notable's risk score. The analyst opens the notable's detail view and looks for a way to pivot directly to the contributing risk events. Which action should the analyst take?

Question 64hardmultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is building a risk rule that assigns a risk score to a user based on the number of failed authentication attempts observed in a 10-minute window. The analyst wants the risk score to increase proportionally with the number of failures, but also wants to avoid generating excessive risk events for every single failure. Which approach best meets these requirements?

Question 65mediummultiple choice

Read the full Investigation And Risk Management explanation →

A SOC analyst is reviewing an investigation in Splunk Enterprise Security and wants to determine whether a specific threat intelligence indicator has been observed in the environment over the past 90 days. Which investigation technique best supports this requirement?

Question 66hardmultiple choice

Read the full Investigation And Risk Management explanation →

A Splunk ES analyst is tuning a correlation search that generates a large number of false positives. The analyst wants to reduce noise without disabling the search entirely. The search currently uses a risk rule that assigns a risk score of 20 to each matching event. Which approach best aligns with risk-based alerting best practices?

Question 67hardmultiple choice

Read the full Investigation And Risk Management explanation →

A risk analyst notices that a user account accumulated a high risk score from multiple contributing risk events, but the score does not reflect the expected sum of the individual risk rule weights. Which factor most likely explains the discrepancy?

Question 68mediummulti select

Read the full Investigation And Risk Management explanation →

A SOC manager is defining a new risk-based alerting (RBA) strategy in Splunk Enterprise Security. The manager wants to ensure that risk events are properly attributed to the correct entities so that risk scores aggregate accurately. Which two actions should the manager take when configuring risk rules? (Choose two.)

Question 69easymultiple choice

Read the full Investigation And Risk Management explanation →

A security analyst is documenting the lifecycle of an investigation in Splunk Enterprise Security. Which statement accurately describes how cases and notables relate within that lifecycle?

Question 70hardmultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is investigating a notable event in Splunk ES and needs to determine which correlation search generated it and what risk objects contributed to its creation. Which Splunk ES feature provides this information directly from the notable event?

Question 71mediummulti select

Read the full Investigation And Risk Management explanation →

A SOC manager is defining requirements for a new detection that should contribute to an entity's risk profile in Splunk Enterprise Security. Which TWO characteristics must the detection have to properly contribute risk to an entity? (Choose two.)

Question 72hardmulti select

Read the full Investigation And Risk Management explanation →

A security analyst is investigating a notable in Splunk ES and needs to determine the potential impact of the threat. The analyst wants to correlate the risk object with asset and identity data to understand the criticality of the affected system and the user's role. Which two actions should the analyst take to enrich the investigation with asset and identity context? (Choose two.)

Question 73easymultiple choice

Read the full Investigation And Risk Management explanation →

A SOC manager wants to review the overall risk posture of the organization by examining the highest-risk users and systems over the past week. Which Splunk Enterprise Security dashboard provides this aggregated view of risk objects and their scores?

Question 74hardmultiple choice

Read the full Investigation And Risk Management explanation →

During an investigation, an analyst needs to correlate a series of authentication failures with subsequent successful logins from the same source across multiple indexers. Which Splunk Enterprise Security capability is most appropriate for this task?

Question 75mediummultiple choice

Read the full Investigation And Risk Management explanation →

During an investigation, an analyst determines that a user's risk score is inflated because a single risk rule is firing repeatedly on benign activity. The analyst wants to reduce the impact of this rule on the user's overall risk score without disabling the rule entirely. What is the most appropriate action?

Question 76easymultiple choice

Read the full Investigation And Risk Management explanation →

A SOC manager wants to ensure that when a notable event is reviewed and closed, the analyst's disposition and any supporting evidence are preserved for audit purposes. Which Splunk ES feature should the manager use to capture this information?

Question 1easymultiple choice

Read the full Investigation And Risk Management explanation →

Which field is mandatory for the Risk Analysis adaptive response action to successfully map an event to a user?

Question 2hardmultiple choice

Read the full Investigation And Risk Management explanation →

You are troubleshooting a scenario where the 'Risk Notable' is not firing as expected. Which log file should you inspect first to confirm if the Risk Analysis action was successfully triggered?

Question 3easymultiple choice

Read the full Investigation And Risk Management explanation →

You are configuring a new Risk-Based Alerting (RBA) workflow. Which component is responsible for transforming raw logs into risk notables within the Splunk Enterprise Security app?

Question 4mediummultiple choice

Read the full Investigation And Risk Management explanation →

Which field must be present in a notable event for it to be displayed in the 'Incident Review' dashboard?

Question 5mediummultiple choice

Read the full Investigation And Risk Management explanation →

If an analyst wants to see all risk events associated with a specific IP address, which search command is most effective?

Question 6hardmulti select

Read the full Investigation And Risk Management explanation →

Which THREE elements are essential for a well-defined risk-based alert?

Question 7mediummulti select

Read the full Investigation And Risk Management explanation →

Which THREE dashboard categories in Splunk ES are most useful for risk-based investigation?

Question 8mediummultiple choice

Read the full Investigation And Risk Management explanation →

A SOC analyst is reviewing a notable event in Splunk Enterprise Security that fired due to a risk-based alert. The analyst wants to quickly pivot from the notable event to the underlying risk events that contributed to the alert. Which action should the analyst take from the notable event's detail view?

Question 9hardmultiple choice

Read the full Investigation And Risk Management explanation →

A fraud analyst is building a risk rule that assigns a risk score of 20 to any user who triggers a "multiple failed logins" detection. The analyst wants the risk score to decay over time so that a user's accumulated risk does not remain elevated indefinitely. Which Splunk Enterprise Security feature should the analyst configure to achieve this?

Question 10hardmultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is investigating a potential insider threat and needs to review all risk events associated with a specific user over the past 30 days. The analyst wants to see the risk score contributions and the rules that generated them. Which search command should the analyst use to retrieve this information from the risk index?

Question 11mediummultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is reviewing a high-severity notable event generated by a correlation search in Splunk Enterprise Security. The analyst wants to document investigative steps, attach supporting evidence, and collaborate with a teammate directly from the notable event. Which Splunk ES feature should the analyst use?

Question 12mediummultiple choice

Read the full Investigation And Risk Management explanation →

A security analyst is reviewing a notable event that was generated by a risk-based alert. The notable's description mentions a risk object of type "user" with the value "jdoe". The analyst wants to see all risk events associated with that user across all time, not just those in the notable's time window. Which search should the analyst run?

Question 13mediummulti select

Read the full Investigation And Risk Management explanation →

A security analyst is reviewing a notable event in Splunk Enterprise Security that was generated by a correlation search. The notable contains an `ip_address` field, a `user` field, and a `signature` field. The analyst wants to pivot from this notable to a prebuilt investigation dashboard that shows all activity related to the involved IP address and user. Which two actions can the analyst take from the notable event to launch the appropriate investigation view? (Choose two.)

Question 14hardmultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is investigating a notable and wants to add a specific event from the search results to an existing case in Splunk Enterprise Security for collaborative tracking. What is the correct procedure to accomplish this?

Question 15mediummultiple choice

Read the full Investigation And Risk Management explanation →

A SOC manager wants to ensure that when a notable is created, the analyst can quickly see the risk score of the associated risk object without running a separate search. Which Splunk ES feature should the manager configure to display this information directly in the notable's detail view?

Question 16hardmulti select

Read the full Investigation And Risk Management explanation →

A security analyst is configuring a new risk rule in Splunk Enterprise Security to detect suspicious PowerShell activity. The analyst wants to ensure the rule contributes to Risk-Based Alerting (RBA) correctly. Which two actions must the analyst take when defining the risk rule? (Choose two.)

Question 17hardmultiple choice

Read the full Investigation And Risk Management explanation →

A Splunk ES analyst is investigating a suspicious login notable. The notable's `user` field is `jdoe`, and the analyst wants to see a chronological list of all risk events for `jdoe` across all risk rules, including the risk rule name and the risk score contributed by each event. Which search provides this view?

Question 18easymultiple choice

Read the full Investigation And Risk Management explanation →

A security analyst in Splunk ES is reviewing a notable event and wants to see the raw event that triggered the correlation search. Which action should the analyst take?

Question 19mediummultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is reviewing a notable that was generated by a risk rule. The notable's risk score is 80, but the analyst wants to understand which specific risk rules contributed to this score. Which Splunk ES component should the analyst use to see the breakdown of risk contributions by rule?

Question 20hardmultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is building an investigation dashboard that should display the top risk entities over the last 24 hours, based on the cumulative risk scores from all risk rules. The dashboard must update in real time as new risk events arrive. Which search should the analyst use as the base query?

Question 21hardmultiple choice

Read the full Investigation And Risk Management explanation →

When calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?

Question 22mediummultiple choice

Read the full Investigation And Risk Management explanation →

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

Question 23mediummultiple choice

Read the full Investigation And Risk Management explanation →

During an investigation, you need to group related notables into a single investigation container. Which feature should you use?

Question 24mediummultiple choice

Read the full Investigation And Risk Management explanation →

A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?

Question 25easymultiple choice

Read the full Investigation And Risk Management explanation →

When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?

Question 26easymultiple choice

Read the full Investigation And Risk Management explanation →

In the context of Splunk ES, what is an 'Asset'?

Question 27mediummultiple choice

Read the full Investigation And Risk Management explanation →

What is the primary function of the 'Risk Notable' correlation search in Splunk ES?

Question 28hardmultiple choice

Read the full Investigation And Risk Management explanation →

When configuring the 'Risk Analysis' adaptive response, what does the 'risk_score' parameter represent?

Question 29hardmultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is investigating an incident where a user's risk score spiked significantly. Which investigative tool allows the analyst to see the timeline of all contributing risk events?

Question 30mediummultiple choice

Read the full Investigation And Risk Management explanation →

An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?

Question 31easymultiple choice

Read the full Investigation And Risk Management explanation →

Which component in Splunk ES is used to manage the lifecycle of an incident, including status updates and assignments?

Question 32mediummultiple choice

Read the full Investigation And Risk Management explanation →

Which data model does the Risk Analysis adaptive response action typically rely upon to enrich events?

Question 33hardmultiple choice

Read the full Investigation And Risk Management explanation →

A correlation search is failing to generate risk events. You check the 'Search Activity' and see that the search is running but returning 0 results. What is the most likely cause?

Question 34easymultiple choice

Read the full Investigation And Risk Management explanation →

What is the benefit of using the Asset and Identity framework in Splunk ES investigations?

Question 35mediummultiple choice

Read the full Investigation And Risk Management explanation →

When investigating a case, where should an analyst document their findings to ensure they are available to other team members?

Question 36hardmultiple choice

Read the full Investigation And Risk Management explanation →

You notice that the risk score for an asset is not decaying. Which configuration controls the risk score lifespan?

Question 37easymultiple choice

Read the full Investigation And Risk Management explanation →

What is the purpose of the 'Investigation Workbench' in Splunk ES?

Question 38easymultiple choice

Read the full Investigation And Risk Management explanation →

Which of the following is a primary benefit of Risk-Based Alerting (RBA) over traditional alerting?

Question 39hardmultiple choice

Read the full Investigation And Risk Management explanation →

When configuring an 'Adaptive Response' action, what does the 'Notable' action type do?

Question 40easymultiple choice

Read the full Investigation And Risk Management explanation →

In the Incident Review dashboard, what does 'Status' represent?

Question 41mediummulti select

Read the full Investigation And Risk Management explanation →

Which THREE features are provided by the Splunk ES Incident Review dashboard?

Question 42mediummultiple choice

Read the full Investigation And Risk Management explanation →

When reviewing an incident, how can an analyst verify if the notable event was generated by a specific correlation search?

Question 43easymulti select

Read the full Investigation And Risk Management explanation →

Which THREE pieces of information are commonly found in a Splunk ES Case?

Question 44mediummulti select

Read the full Investigation And Risk Management explanation →

Which TWO methods can be used to suppress unwanted notable events?

Question 45hardmultiple choice

Read the full Investigation And Risk Management explanation →

If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?

Question 46easymulti select

Read the full Investigation And Risk Management explanation →

Which TWO of the following are key components of a successful incident investigation workflow in Splunk ES?

Question 47hardmulti select

Read the full Investigation And Risk Management explanation →

Which TWO actions can be taken on a notable event directly from the Incident Review dashboard?

Question 48easymulti select

Read the full Investigation And Risk Management explanation →

Which TWO types of data are commonly enriched by the Asset and Identity framework?

Question 49hardmulti select

Read the full Investigation And Risk Management explanation →

Which TWO factors influence an object's final risk score in Splunk ES?

Question 50easymulti select

Read the full Investigation And Risk Management explanation →

Which THREE actions are part of the 'Incident Review' investigation workflow?

Question 51mediummulti select

Read the full Investigation And Risk Management explanation →

Which TWO metrics are tracked in the 'Incident Review' dashboard's 'Notable Event' list?

Question 52hardmulti select

Read the full Investigation And Risk Management explanation →

Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?

Question 53easymulti select

Read the full Investigation And Risk Management explanation →

Which TWO areas of the Splunk ES environment are used to manage risk-based alerting configurations?

Question 54mediummultiple choice

Read the full Investigation And Risk Management explanation →

A SOC analyst is reviewing a notable event in Splunk Enterprise Security that was generated from a correlation search firing against a risk index. The analyst wants to see the individual risk events that contributed to the notable's risk score, including the contributing risk rules and their individual risk scores. Which action should the analyst take?

Question 55mediummultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is reviewing a notables queue in Splunk Enterprise Security and wants to understand why a particular correlation search generated a high-severity finding. The analyst opens the finding in Incident Review and notices the severity is set to 'high', but the contributing risk score is only 40. Which component of the correlation search configuration most directly determines the severity displayed on the finding?

Question 56hardmultiple choice

Read the full Investigation And Risk Management explanation →

A SOC analyst is building a risk-based alerting workflow and wants to ensure that a specific risk rule only contributes to an entity's risk score when the entity is a user account, not a system or IP address. Which configuration in the risk rule's search definition accomplishes this?

Question 57easymultiple choice

Read the full Investigation And Risk Management explanation →

A security analyst receives a notable event about suspicious PowerShell execution on a workstation. To gather more context, the analyst wants to see all events related to the involved host from the last 24 hours in a single view. Which Splunk ES feature provides this consolidated timeline of activity for an entity?

Question 58mediummultiple choice

Read the full Investigation And Risk Management explanation →

A SOC analyst is reviewing a notable event for a suspected compromised host. The analyst wants to enrich the investigation by viewing the raw event that triggered the detection, along with the associated risk events and threat intelligence matches, directly from the notable event in Splunk Enterprise Security. Which feature should the analyst use to access this consolidated context?

Question 59hardmultiple choice

Read the full Investigation And Risk Management explanation →

A risk analyst notices that a particular risk rule is generating an excessive number of risk events for low-severity activities, causing alert fatigue. The analyst wants to reduce the impact of this rule on overall risk scores without disabling it entirely. What is the most appropriate action?

Question 60mediummulti select

Read the full Investigation And Risk Management explanation →

A SOC manager is defining a new risk-based alerting strategy and wants to ensure that risk events generated by correlation searches are properly attributed and actionable. Which TWO fields are required in a risk event for the Risk Analysis framework to correctly associate risk with an entity and contribute to its score? (Choose two.)

Question 61mediummulti select

Read the full Investigation And Risk Management explanation →

A security analyst is documenting the key phases of a Splunk Enterprise Security investigation workflow for a new team member. Which two phases are essential components of this workflow? (Choose two.)

Question 62easymultiple choice

Read the full Investigation And Risk Management explanation →

A junior analyst is asked to find all risk events associated with a specific user account to assess potential insider threat activity. Which search command should the analyst use to retrieve these risk events from the risk index?

Question 63mediummultiple choice

Read the full Investigation And Risk Management explanation →

A SOC analyst is reviewing a notables list in Splunk Enterprise Security and wants to see the individual risk events that contributed to a specific notable's risk score. The analyst opens the notable's detail view and looks for a way to pivot directly to the contributing risk events. Which action should the analyst take?

Question 64hardmultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is building a risk rule that assigns a risk score to a user based on the number of failed authentication attempts observed in a 10-minute window. The analyst wants the risk score to increase proportionally with the number of failures, but also wants to avoid generating excessive risk events for every single failure. Which approach best meets these requirements?

Question 65mediummultiple choice

Read the full Investigation And Risk Management explanation →

A SOC analyst is reviewing an investigation in Splunk Enterprise Security and wants to determine whether a specific threat intelligence indicator has been observed in the environment over the past 90 days. Which investigation technique best supports this requirement?

Question 66hardmultiple choice

Read the full Investigation And Risk Management explanation →

A Splunk ES analyst is tuning a correlation search that generates a large number of false positives. The analyst wants to reduce noise without disabling the search entirely. The search currently uses a risk rule that assigns a risk score of 20 to each matching event. Which approach best aligns with risk-based alerting best practices?

Question 67hardmultiple choice

Read the full Investigation And Risk Management explanation →

A risk analyst notices that a user account accumulated a high risk score from multiple contributing risk events, but the score does not reflect the expected sum of the individual risk rule weights. Which factor most likely explains the discrepancy?

Question 68mediummulti select

Read the full Investigation And Risk Management explanation →

A SOC manager is defining a new risk-based alerting (RBA) strategy in Splunk Enterprise Security. The manager wants to ensure that risk events are properly attributed to the correct entities so that risk scores aggregate accurately. Which two actions should the manager take when configuring risk rules? (Choose two.)

Question 69easymultiple choice

Read the full Investigation And Risk Management explanation →

A security analyst is documenting the lifecycle of an investigation in Splunk Enterprise Security. Which statement accurately describes how cases and notables relate within that lifecycle?

Question 70hardmultiple choice

Read the full Investigation And Risk Management explanation →

An analyst is investigating a notable event in Splunk ES and needs to determine which correlation search generated it and what risk objects contributed to its creation. Which Splunk ES feature provides this information directly from the notable event?

Question 71mediummulti select

Read the full Investigation And Risk Management explanation →

A SOC manager is defining requirements for a new detection that should contribute to an entity's risk profile in Splunk Enterprise Security. Which TWO characteristics must the detection have to properly contribute risk to an entity? (Choose two.)

Question 72hardmulti select

Read the full Investigation And Risk Management explanation →

A security analyst is investigating a notable in Splunk ES and needs to determine the potential impact of the threat. The analyst wants to correlate the risk object with asset and identity data to understand the criticality of the affected system and the user's role. Which two actions should the analyst take to enrich the investigation with asset and identity context? (Choose two.)

Question 73easymultiple choice

Read the full Investigation And Risk Management explanation →

A SOC manager wants to review the overall risk posture of the organization by examining the highest-risk users and systems over the past week. Which Splunk Enterprise Security dashboard provides this aggregated view of risk objects and their scores?

Question 74hardmultiple choice

Read the full Investigation And Risk Management explanation →

During an investigation, an analyst needs to correlate a series of authentication failures with subsequent successful logins from the same source across multiple indexers. Which Splunk Enterprise Security capability is most appropriate for this task?

Question 75mediummultiple choice

Read the full Investigation And Risk Management explanation →

During an investigation, an analyst determines that a user's risk score is inflated because a single risk rule is firing repeatedly on benign activity. The analyst wants to reduce the impact of this rule on the user's overall risk score without disabling the rule entirely. What is the most appropriate action?

Question 76easymultiple choice

Read the full Investigation And Risk Management explanation →

A SOC manager wants to ensure that when a notable event is reviewed and closed, the analyst's disposition and any supporting evidence are preserved for audit purposes. Which Splunk ES feature should the manager use to capture this information?