SPLK-5001 Investigation And Risk Management Practice Test 2 — 15 Questions

Question 1

A security analyst is configuring a new risk rule in Splunk Enterprise Security to detect suspicious PowerShell activity. The analyst wants to ensure the rule contributes to Risk-Based Alerting (RBA) correctly. Which two actions must the analyst take when defining the risk rule? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set a risk score value that reflects the severity of the detected activity.. For a correlation search to contribute to Risk-Based Alerting, it must include a risk action that specifies the risk object, risk object type, and a risk score. These elements ensure the risk event is properly attributed and weighted. Other actions like Notable or throttle are not required and can interfere with RBA if misused.

Answer

Enable the "Notable" action to ensure the event appears in Incident Review.

Answer

Add the risk rule to a correlation search that runs on a schedule.

Answer

Configure a throttle to limit the number of risk events per risk object.

Question 2

A Splunk ES analyst is investigating a suspicious login notable. The notable's `user` field is `jdoe`, and the analyst wants to see a chronological list of all risk events for `jdoe` across all risk rules, including the risk rule name and the risk score contributed by each event. Which search provides this view?

Accepted Answer

`| from datamodel:"Risk.All_Risk" | search risk_object=jdoe | table _time, rule_name, risk_score, risk_object`. Risk events are stored in the Risk data model, and the risk_object field identifies the entity the risk applies to. Searching the All_Risk dataset for risk_object=jdoe returns every risk event for that user across all risk rules, with rule_name and risk_score available for review. This is the correct way to see all risk contributions for a specific entity.

Answer

`index=risk user=jdoe | table _time, rule_name, risk_score, risk_object`

Answer

`| tstats summariesonly=t count from datamodel:"Risk.All_Risk" by _time, rule_name, risk_score`

Answer

`index=notable user=jdoe | table _time, rule_name, risk_score, risk_object`

Question 3

A security analyst in Splunk ES is reviewing a notable event and wants to see the raw event that triggered the correlation search. Which action should the analyst take?

Accepted Answer

Use the 'Actions' menu and select 'Show raw event'.. From the Incident Review dashboard, the Actions menu on a notable event provides a 'Show raw event' option that runs a search to display the original event. This is the direct and intended way to view the raw event from a notable. Other methods either show aggregated data, search the wrong index, or rely on a button that may not exist. The Actions menu is the standard location for this and other investigative actions.

Answer

Open the Risk Analysis dashboard and filter by the notable's risk object.

Answer

Click the 'Event Details' link and then the 'View raw event' button.

Answer

Run a search on the notable index for the notable's event ID.

Question 4

An analyst is reviewing a notable that was generated by a risk rule. The notable's risk score is 80, but the analyst wants to understand which specific risk rules contributed to this score. Which Splunk ES component should the analyst use to see the breakdown of risk contributions by rule?

Accepted Answer

The Risk Analysis dashboard's 'Risk Rule' view, which lists risk rules and their contributions to the risk score.. The Risk Analysis dashboard's Risk Rule view is the built-in component that lists risk rules and their contributions to risk scores. It allows the analyst to see which rules contributed to a specific risk object's score, providing the needed breakdown. Other options either do not exist or require manual search construction.

Answer

A custom search using the 'tstats' command on the risk index, grouped by rule name.

Answer

The Incident Review dashboard's 'Risk Contributors' panel, which aggregates risk scores by rule.

Answer

The Asset Investigator's 'Risk Rules' tab, which displays rules associated with the asset.

Question 5

An analyst is building an investigation dashboard that should display the top risk entities over the last 24 hours, based on the cumulative risk scores from all risk rules. The dashboard must update in real time as new risk events arrive. Which search should the analyst use as the base query?

Accepted Answer

`| tstats summariesonly=t sum(All_Risk.risk_score) as total_risk from datamodel:"Risk.All_Risk" by All_Risk.risk_object | sort -total_risk | head 10`. The Risk data model accelerates risk events and supports tstats queries that use summariesonly=t for fast aggregation. Summing risk_score by risk_object over the last 24 hours and sorting descending yields the top risk entities. This approach is efficient and appropriate for a dashboard that must update as new risk events are indexed.

Answer

`index=risk earliest=-24h | stats sum(risk_score) as total_risk by risk_object | sort -total_risk | head 10`

Answer

`| from datamodel:"Risk.All_Risk" | stats sum(risk_score) as total_risk by risk_object | sort -total_risk | head 10`

Answer

`index=notable earliest=-24h | stats sum(risk_score) as total_risk by risk_object | sort -total_risk | head 10`

Question 6

When calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?

Accepted Answer

The scores are additive.. When the Risk Analysis framework uses the 'sum' aggregation method, risk scores from multiple risk events for the same object within the same time window are added together. This additive behavior means an object with three risk events scoring 20, 30, and 50 would have a total risk score of 100 for that window.

Answer

Only the highest score is kept.

Answer

The scores are averaged.

Answer

The risk score is reset to zero.

Question 7

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

Accepted Answer

Correlation Search Editor. Risk rule weights are defined as part of the correlation search definition itself, so the weight is edited in the Correlation Search Editor within Enterprise Security. The editor exposes the risk analysis configuration, including the risk object fields and the risk score/weight assigned when the search fires. Changing the weight anywhere else would not affect how the correlation search writes risk events.

Answer

Identity Manager

Answer

Risk Index Configuration

Answer

Risk Notable Settings

Question 8

During an investigation, you need to group related notables into a single investigation container. Which feature should you use?

Accepted Answer

Splunk Case Management. Splunk Enterprise Security's Case Management feature lets analysts group related notables into a single investigation container, track status, assign owners, and document findings. It is designed specifically for organizing multiple notables that belong to the same incident. Aggregation, suppression, and filters do not create investigation containers.

Answer

Notable Event Aggregation

Answer

Notable Event Suppression

Answer

Incident Review Filters

Question 9

A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?

Accepted Answer

Correlation Search Suppression. Correlation Search Suppression is the mechanism in Enterprise Security for filtering out specific events from a correlation search's results, including low-fidelity risk events. Suppression rules let you define field-based conditions (e.g., specific risk_object or signature) so matching events are excluded before they generate risk or notables, which is exactly what the customer needs.

Answer

Risk Index Retention Policy

Answer

Data Model Acceleration

Answer

Asset and Identity Table

Question 10

When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?

Accepted Answer

Risk Analysis Dashboard. The Risk Analysis Dashboard in Splunk ES provides a visual breakdown of risk contributors for a specific user (or other entity), showing which correlation searches contributed risk, the risk scores over time, and the risk objects involved. It is the go-to dashboard for understanding why a user's risk score is elevated and which detections drove it. This directly supports investigating a risk notable.

Answer

Threat Activity Dashboard

Answer

Access Anomalies Dashboard

Answer

Incident Review

Question 11

In the context of Splunk ES, what is an 'Asset'?

Accepted Answer

An entity like a host or server.. In Splunk Enterprise Security, an 'Asset' is a normalized representation of an entity such as a host, server, endpoint, or device that is part of the IT infrastructure. Assets are defined in the Asset and Identity framework via CSV lookups and are used to enrich events with context (e.g., owner, priority, category). A malicious IP address is a threat indicator, not an asset.

Answer

A malicious IP address.

Answer

A saved search report.

Answer

A notable event.

Question 12

What is the primary function of the 'Risk Notable' correlation search in Splunk ES?

Accepted Answer

To alert when an object's risk score exceeds a threshold.. The Risk Notable correlation search in Splunk ES aggregates risk events per risk object and fires a notable when the summed risk score crosses a configured threshold. Its purpose is to convert accumulated risk into an actionable notable event for analysts, rather than to generate the underlying risk events themselves. This is the bridge between the risk framework and the Incident Review queue.

Answer

To clear old risk events from memory.

Answer

To generate risk events from logs.

Answer

To update the asset and identity table.

Question 13

When configuring the 'Risk Analysis' adaptive response, what does the 'risk_score' parameter represent?

Accepted Answer

The value added to the object's risk score.. In the Risk Analysis adaptive response, the 'risk_score' parameter specifies the numeric value that will be added to the risk score of the object (user, system, or other entity) associated with the notable event. It is the incremental contribution of that specific risk event, not the object's total score or a threshold.

Answer

The severity level of the notable event.

Answer

The threshold for triggering a notable.

Answer

The total risk score for the object.

Question 14

An analyst is investigating an incident where a user's risk score spiked significantly. Which investigative tool allows the analyst to see the timeline of all contributing risk events?

Accepted Answer

Risk Analysis Dashboard. The Risk Analysis Dashboard in Splunk Enterprise Security is purpose-built to visualize risk scores and the underlying risk events that contributed to them. It shows a timeline of risk events per entity (user, system, etc.), letting the analyst trace exactly which detections drove the score spike.

Answer

Security Posture Dashboard

Answer

Investigation Workbench

Answer

Incident Review

Question 15

An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?

Accepted Answer

Select the event in Incident Review and choose 'Add to Case'.. In Splunk Enterprise Security, the Incident Review dashboard is the primary triage interface where analysts view notable events and can take actions on them. To manually add an event to an existing case, the analyst selects the event within Incident Review and uses the 'Add to Case' action, which associates that event with the chosen case for investigation. This is the documented, supported workflow for enriching a case with additional evidence.

Answer

Edit the correlation search definition.

Answer

Modify the risk index directly.

Answer

Use the Case Management dashboard to search for the event ID.