SPLK-5001 Investigation And Risk Management Practice Test 2 — 15 Questions

Question 1

Which data model does the Risk Analysis adaptive response action typically rely upon to enrich events?

Accepted Answer

Risk Data Model. While it can run on raw events, the Risk Analysis action is often used in correlation searches that monitor data models like 'Network Traffic' or 'Authentication'.

Answer

Vulnerability Data Model

Answer

Threat Intelligence Data Model

Answer

Endpoint Data Model

Question 2

A correlation search is failing to generate risk events. You check the 'Search Activity' and see that the search is running but returning 0 results. What is the most likely cause?

Accepted Answer

The search logic does not match the data.. If the search returns no results, the logic inside the search is likely too restrictive, such as incorrect data model mapping or field names.

Answer

The Splunk indexer is overloaded.

Answer

The user does not have permission to write to the risk index.

Answer

The Risk Analysis action is disabled.

Question 3

What is the benefit of using the Asset and Identity framework in Splunk ES investigations?

Accepted Answer

It provides context to events.. It provides contextual information (like user departments or host ownership) to notable events, allowing for better prioritization and investigation.

Answer

It hides false positives.

Answer

It automatically generates risk scores.

Answer

It replaces the need for data models.

Question 4

When investigating a case, where should an analyst document their findings to ensure they are available to other team members?

Accepted Answer

In the 'Comments' section of the Case.. Case Management supports adding comments or notes to a case to facilitate collaboration.

Answer

In the splunkd.log file.

Answer

By modifying the correlation search.

Answer

In the Asset and Identity manager.

Question 5

You notice that the risk score for an asset is not decaying. Which configuration controls the risk score lifespan?

Accepted Answer

Risk Analysis configuration in ES Settings.. The 'Risk Analysis' settings in the ES app configuration dictate how long risk scores persist before decaying.

Answer

Data model acceleration TTL.

Answer

Search Scheduler settings.

Answer

Notable event retention settings.

Question 6

What is the purpose of the 'Investigation Workbench' in Splunk ES?

Accepted Answer

To provide a unified view of incident artifacts.. The Investigation Workbench provides a centralized view of all entities, events, and context related to a specific incident.

Answer

To run administrative index maintenance.

Answer

To manage user identities.

Answer

To configure correlation searches.

Question 7

If an analyst wants to see all risk events associated with a specific IP address, which search command is most effective?

Accepted Answer

tstats count from datamodel=Risk where Risk.src_ip=.... The 'tstats' command is the most efficient way to query the risk data model for events associated with a specific field value.

Answer

collect index=risk

Answer

lookup asset_info

Answer

search index=risk src_ip=...

Question 8

Which of the following is a primary benefit of Risk-Based Alerting (RBA) over traditional alerting?

Accepted Answer

It focuses on aggregated behavior to reduce noise.. RBA reduces alert fatigue by focusing on aggregated activity rather than single, potentially noisy events.

Answer

It alerts on every single event.

Answer

It eliminates the need for correlation searches.

Answer

It ignores all low-severity events.

Question 9

When configuring an 'Adaptive Response' action, what does the 'Notable' action type do?

Accepted Answer

Creates an entry in the Incident Review dashboard.. The 'Notable' action type specifically triggers the creation of a notable event in the Incident Review dashboard.

Answer

Updates the asset identity table.

Answer

Assigns a risk score to an event.

Answer

Sends an email alert.

Question 10

In the Incident Review dashboard, what does 'Status' represent?

Accepted Answer

The stage of the investigation workflow.. Status tracks the progress of an investigation, such as 'New', 'In Progress', or 'Closed'.

Answer

The assignment to an analyst.

Answer

The severity of the threat.

Answer

The risk score of the notable.

Question 11

Which THREE features are provided by the Splunk ES Incident Review dashboard?

Accepted Answer

Status management. The Incident Review dashboard is the hub for notable event triage, status tracking, and assignment.

Answer

Risk score threshold configuration

Answer

Threat intelligence feed management

Question 12

When reviewing an incident, how can an analyst verify if the notable event was generated by a specific correlation search?

Accepted Answer

By checking the 'Search Name' field.. The 'Search Name' field in the Incident Review dashboard clearly identifies the correlation search that triggered the notable.

Answer

By running a search for the object.

Answer

By checking the 'Event ID'.

Answer

By looking at the index name.

Question 13

Which THREE pieces of information are commonly found in a Splunk ES Case?

Accepted Answer

Investigation metadata (status, owner). Cases are containers that hold key artifacts, comments from analysts, and links to relevant notable events.

Answer

Raw indexer performance logs

Answer

System health metrics

Question 14

Which TWO methods can be used to suppress unwanted notable events?

Accepted Answer

Correlation search suppression. Notable event suppression and correlation search suppression are the standard ways to manage alert noise.

Answer

Deleting the raw event from the index

Answer

Changing the user account password

Answer

Disabling the data model

Question 15

If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?

Accepted Answer

Splunk Index Manager interface.. Index retention policies are managed in the Splunk index settings (indexes.conf) or via the Manager interface.

Answer

ES app settings.

Answer

Data model acceleration settings.

Answer

Correlation Search Editor.