SPLK-5001 Investigation And Risk Management Practice Test 3 — 15 Questions

Question 1

Which component in Splunk ES is used to manage the lifecycle of an incident, including status updates and assignments?

Accepted Answer

Case Management. Case Management in Splunk Enterprise Security is the component that manages the lifecycle of an incident, including status updates, assignments, and other workflow actions. It allows analysts to create cases from notable events, track their progress, and collaborate on investigations. This is distinct from Incident Review, which is primarily for viewing and triaging notable events, not for managing the full incident lifecycle.

Answer

Notable Event Suppression

Answer

Risk Analysis Dashboard

Answer

Incident Review

Question 2

Which data model does the Risk Analysis adaptive response action typically rely upon to enrich events?

Accepted Answer

Risk Data Model. The Risk Analysis adaptive response action enriches events by writing risk events to the risk index using the Risk Data Model, which defines risk objects, risk scores, and risk annotations. The action populates fields like risk_object, risk_object_type, risk_score, and risk_message, all of which are structured by the Risk Data Model. This model is what the Risk Framework uses to aggregate and display risk.

Answer

Vulnerability Data Model

Answer

Threat Intelligence Data Model

Answer

Endpoint Data Model

Question 3

A correlation search is failing to generate risk events. You check the 'Search Activity' and see that the search is running but returning 0 results. What is the most likely cause?

Accepted Answer

The search logic does not match the data.. A correlation search that runs successfully but returns 0 results indicates the search's filtering conditions (e.g., field values, thresholds, time windows, or index/sourcetype references) don't match any events in the data. Since the search executes without error, the issue is with the logic-to-data alignment, not infrastructure or permissions.

Answer

The Splunk indexer is overloaded.

Answer

The user does not have permission to write to the risk index.

Answer

The Risk Analysis action is disabled.

Question 4

What is the benefit of using the Asset and Identity framework in Splunk ES investigations?

Accepted Answer

It provides context to events.. The Asset and Identity framework in Splunk ES enriches events with contextual information such as asset owner, priority, category, and identity details (e.g., department, role). This context helps analysts quickly understand the who, what, and where of an event, prioritize investigations, and make faster decisions. It does not hide false positives, automatically generate risk scores, or replace data models.

Answer

It hides false positives.

Answer

It automatically generates risk scores.

Answer

It replaces the need for data models.

Question 5

When investigating a case, where should an analyst document their findings to ensure they are available to other team members?

Accepted Answer

In the 'Comments' section of the Case.. In Splunk Enterprise Security, the Case Management feature provides a 'Comments' section where analysts can document investigation findings, and these comments are stored with the case and visible to all team members who have access to the case. This ensures collaboration and continuity across shifts.

Answer

In the splunkd.log file.

Answer

By modifying the correlation search.

Answer

In the Asset and Identity manager.

Question 6

You notice that the risk score for an asset is not decaying. Which configuration controls the risk score lifespan?

Accepted Answer

Risk Analysis configuration in ES Settings.. The risk score lifespan (decay) is configured in the Risk Analysis configuration within ES Settings. This setting defines how long risk events contribute to an object's risk score before decaying, and it controls the decay rate applied to risk scores over time. If decay is not occurring, this configuration is where to investigate.

Answer

Data model acceleration TTL.

Answer

Search Scheduler settings.

Answer

Notable event retention settings.

Question 7

What is the purpose of the 'Investigation Workbench' in Splunk ES?

Accepted Answer

To provide a unified view of incident artifacts.. The Investigation Workbench in Splunk Enterprise Security provides analysts with a unified, single-pane view of all artifacts related to an incident — events, risk scores, assets, identities, and related notables — so they can pivot and correlate without jumping between dashboards. It aggregates context from multiple sources into one investigative surface. This is distinct from administrative or configuration functions.

Answer

To run administrative index maintenance.

Answer

To manage user identities.

Answer

To configure correlation searches.

Question 8

Which of the following is a primary benefit of Risk-Based Alerting (RBA) over traditional alerting?

Accepted Answer

It focuses on aggregated behavior to reduce noise.. Risk-Based Alerting aggregates risk contributions from multiple detections into a single risk score per entity, then alerts only when the score crosses a threshold. This focuses analysts on correlated, aggregated behavior rather than individual low-fidelity events, dramatically reducing alert noise while surfacing meaningful attack patterns.

Answer

It alerts on every single event.

Answer

It eliminates the need for correlation searches.

Answer

It ignores all low-severity events.

Question 9

When configuring an 'Adaptive Response' action, what does the 'Notable' action type do?

Accepted Answer

Creates an entry in the Incident Review dashboard.. The 'Notable' adaptive response action in Splunk ES creates a notable event that appears in the Incident Review dashboard, allowing analysts to triage, assign, and track the finding. It's the primary mechanism for surfacing correlation search hits to the SOC workflow.

Answer

Updates the asset identity table.

Answer

Assigns a risk score to an event.

Answer

Sends an email alert.

Question 10

In the Incident Review dashboard, what does 'Status' represent?

Accepted Answer

The stage of the investigation workflow.. In the Splunk Enterprise Security Incident Review dashboard, the 'Status' field represents the stage of the investigation workflow — values like New, In Progress, Pending, Resolved, and Closed track where an analyst is in the triage process. It is a workflow state, not a severity, risk score, or ownership field. This is distinct from 'Urgency', 'Severity', and 'Owner', which are separate columns.

Answer

The assignment to an analyst.

Answer

The severity of the threat.

Answer

The risk score of the notable.

Question 11

Which THREE features are provided by the Splunk ES Incident Review dashboard?

Accepted Answer

Status management. The Splunk ES Incident Review dashboard provides Status management (A), allowing analysts to change a notable event's status through the workflow (e.g., New, In Progress, Resolved, Closed) to track triage progress. It also supports Notable event assignment (C), letting analysts assign notables to a specific owner or analyst for accountability. Additionally, it offers Notable event filtering (D), enabling analysts to narrow the notable list by fields such as urgency, status, owner, or source. Option B is incorrect because risk score threshold configuration is done via correlation search settings or the Risk Framework, not on the Incident Review dashboard. Option E is incorrect because threat intelligence feed management is handled through the Threat Intelligence Framework and its associated configurations, not the Incident Review dashboard.

Answer

Risk score threshold configuration

Answer

Threat intelligence feed management

Question 12

When reviewing an incident, how can an analyst verify if the notable event was generated by a specific correlation search?

Accepted Answer

By checking the 'Search Name' field.. Notable events in Splunk Enterprise Security include a field called 'Search Name' that identifies the correlation search that generated the event. By checking this field, an analyst can verify which specific correlation search produced the notable event. The other options do not provide that direct linkage.

Answer

By running a search for the object.

Answer

By checking the 'Event ID'.

Answer

By looking at the index name.

Question 13

Which THREE pieces of information are commonly found in a Splunk ES Case?

Accepted Answer

Investigation metadata (status, owner). Option A is correct because a Splunk ES Case stores investigation metadata such as status (e.g., New, In Progress, Closed) and owner (the assigned analyst), which drive case workflow and accountability. Option B is correct because analysts add comments and notes to a case to document findings, hypotheses, and actions taken during the investigation. Option D is correct because Notable Events are the primary artifacts attached to a case, linking the correlated detections that triggered the investigation to the case record. Option C is not correct because raw indexer performance logs (e.g., splunkd.log, metrics.log) are infrastructure/diagnostic data, not case content. Option E is not correct because system health metrics belong to monitoring tools like the Monitoring Console, not to an ES Case.

Answer

Raw indexer performance logs

Answer

System health metrics

Question 14

Which TWO methods can be used to suppress unwanted notable events?

Accepted Answer

Correlation search suppression. Correlation search suppression (A) is correct because it lets you configure a correlation search to suppress the creation of notable events when specified conditions are met, such as a suppression field or time window, directly preventing unwanted notables at the search level. Notable event suppression (D) is correct because it allows you to suppress individual or grouped notable events after they are generated, using rules based on fields like rule name, source, or severity, so recurring or duplicate notables are hidden from analysts. Deleting the raw event from the index (B) is not a valid suppression method; it destroys source data, affects all searches, and does not target notable events specifically. Changing the user account password (C) is unrelated to event suppression and only affects authentication. Disabling the data model (E) would break the correlation searches and dashboards that depend on it rather than selectively suppressing unwanted notable events.

Answer

Deleting the raw event from the index

Answer

Changing the user account password

Answer

Disabling the data model

Question 15

If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?

Accepted Answer

Splunk Index Manager interface.. The 'risk' index is a standard Splunk index, so its retention (frozenTimePeriodInSecs) is managed through the Splunk Index Manager interface (Settings > Indexes in Splunk Web, or indexes.conf). ES does not override index retention through its own app settings, so the Index Manager is the correct place to modify retention for the risk index.

Answer

ES app settings.

Answer

Data model acceleration settings.

Answer

Correlation Search Editor.