SPLK-5001 Investigation And Risk Management Practice Test 1 — 15 Questions

Question 1

Which field is mandatory for the Risk Analysis adaptive response action to successfully map an event to a user?

Accepted Answer

risk_object. The 'risk_object' field is essential for identifying the entity that the risk is being attributed to.

Answer

signature

Answer

src_ip

Answer

user_id

Question 2

Which field must be present in a notable event for it to be displayed in the 'Incident Review' dashboard?

Accepted Answer

is_notable=1. Notable events are identified by specific fields that Splunk ES uses to map them to the dashboard.

Answer

owner

Answer

incident_id

Answer

risk_score

Question 3

When calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?

Accepted Answer

The scores are additive.. The 'sum' aggregation method cumulatively adds the risk score of every incident to the total score of the object.

Answer

Only the highest score is kept.

Answer

The scores are averaged.

Answer

The risk score is reset to zero.

Question 4

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

Accepted Answer

Correlation Search Editor. Risk rules are often defined within the correlation search itself, where the risk score is mapped to the event severity.

Answer

Identity Manager

Answer

Risk Index Configuration

Answer

Risk Notable Settings

Question 5

During an investigation, you need to group related notables into a single investigation container. Which feature should you use?

Accepted Answer

Splunk Case Management. In Splunk ES, 'Cases' are the primary mechanism for grouping and managing related notable events during an investigation.

Answer

Notable Event Aggregation

Answer

Notable Event Suppression

Answer

Incident Review Filters

Question 6

You are troubleshooting a scenario where the 'Risk Notable' is not firing as expected. Which log file should you inspect first to confirm if the Risk Analysis action was successfully triggered?

Accepted Answer

splunkd.log. The splunkd.log file contains internal diagnostic information about adaptive response actions executed by the correlation search scheduler.

Answer

correlation_search.log

Answer

notable_events.log

Answer

risk_index.log

Question 7

A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?

Accepted Answer

Correlation Search Suppression. Notable event suppression is the native method in Splunk ES to prevent specific event types from triggering notables based on criteria.

Answer

Risk Index Retention Policy

Answer

Data Model Acceleration

Answer

Asset and Identity Table

Question 8

When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?

Accepted Answer

Risk Analysis Dashboard. The Risk Analysis dashboard allows analysts to drill down into the specific risk events contributing to a user's total risk score.

Answer

Threat Activity Dashboard

Answer

Access Anomalies Dashboard

Answer

Incident Review

Question 9

You are configuring a new Risk-Based Alerting (RBA) workflow. Which component is responsible for transforming raw logs into risk notables within the Splunk Enterprise Security app?

Accepted Answer

Risk Analysis Adaptive Response Action. The Risk Analysis adaptive response action is the core mechanism in Splunk ES used to generate risk events from notable events or correlation searches.

Answer

Asset and Identity Framework

Answer

Correlation Search Editor

Answer

Notable Event Suppression

Question 10

In the context of Splunk ES, what is an 'Asset'?

Accepted Answer

An entity like a host or server.. An asset represents an entity in the environment, such as a host or server, which is stored in the asset and identity framework for context enrichment.

Answer

A malicious IP address.

Answer

A saved search report.

Answer

A notable event.

Question 11

What is the primary function of the 'Risk Notable' correlation search in Splunk ES?

Accepted Answer

To alert when an object's risk score exceeds a threshold.. The 'Risk Notable' search monitors the 'risk' index and triggers a notable event when an object's aggregated risk score exceeds a defined threshold.

Answer

To clear old risk events from memory.

Answer

To generate risk events from logs.

Answer

To update the asset and identity table.

Question 12

When configuring the 'Risk Analysis' adaptive response, what does the 'risk_score' parameter represent?

Accepted Answer

The value added to the object's risk score.. The 'risk_score' is the value assigned to an event to quantify the level of risk associated with that activity.

Answer

The severity level of the notable event.

Answer

The threshold for triggering a notable.

Answer

The total risk score for the object.

Question 13

An analyst is investigating an incident where a user's risk score spiked significantly. Which investigative tool allows the analyst to see the timeline of all contributing risk events?

Accepted Answer

Risk Analysis Dashboard. The 'Risk Analysis' dashboard displays a timeline and list of events that contributed to an object's current risk score.

Answer

Security Posture Dashboard

Answer

Investigation Workbench

Answer

Incident Review

Question 14

An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?

Accepted Answer

Select the event in Incident Review and choose 'Add to Case'.. From the Incident Review dashboard, analysts can select a notable event and use the 'Action' menu to assign it to an existing case.

Answer

Edit the correlation search definition.

Answer

Modify the risk index directly.

Answer

Use the Case Management dashboard to search for the event ID.

Question 15

Which component in Splunk ES is used to manage the lifecycle of an incident, including status updates and assignments?

Accepted Answer

Case Management. Case Management provides the structure and tools for incident lifecycle management.

Answer

Notable Event Suppression

Answer

Risk Analysis Dashboard

Answer

Incident Review