SPLK-5001 Investigation And Risk Management Practice Test 4 — 15 Questions

Question 1

Which TWO of the following are key components of a successful incident investigation workflow in Splunk ES?

Accepted Answer

Case documentation and updates. In Splunk Enterprise Security, a successful incident investigation workflow begins with notable event triage (E), where analysts review and prioritize notable events generated by correlation searches, assign urgency, status, and ownership, and decide whether to escalate to a full investigation. Case documentation and updates (B) are equally essential, since Splunk ES uses the Investigation workbench and case management to record findings, attach evidence, add comments, and track status so the investigation is auditable and shareable across the SOC team. Automated index deletion (A) is not part of investigation workflow and would destroy forensic evidence, while user password resets (C) are an identity/response action, not an investigation component. Manual correlation search coding (D) is a detection-engineering task for creating or tuning correlation searches, not a key component of the investigation workflow itself.

Answer

Automated index deletion

Answer

User password resets

Answer

Manual correlation search coding

Question 2

Which TWO actions can be taken on a notable event directly from the Incident Review dashboard?

Accepted Answer

Change the notable event status. Option A is correct because the Incident Review dashboard in Splunk Enterprise Security lets analysts change a notable event's status (e.g., New, In Progress, Resolved, Closed) directly from the event's row or detail view to reflect triage progress. Option B is correct because the dashboard provides the ability to run adaptive response actions (such as sending email, running a script, or triggering other configured actions) on a notable event without leaving the review workflow. Option C is not correct because correlation search code is edited in the Correlation Search editor or via configuration files, not from the Incident Review dashboard. Option D is not correct because rebuilding the threat intelligence index is an administrative maintenance task performed through threat intelligence management, not an incident review action. Option E is not correct because deleting an underlying index is a destructive administrative operation done in Settings, not from the Incident Review dashboard.

Answer

Modify the correlation search code

Answer

Rebuild the threat intelligence index

Answer

Delete the underlying index

Question 3

Which TWO types of data are commonly enriched by the Asset and Identity framework?

Accepted Answer

Host/Asset context. The Asset and Identity framework in Splunk ES is designed to correlate events with contextual metadata about hosts and users, so option A (Host/Asset context) is correct because it enriches events with asset attributes such as IP, MAC, hostname, priority, and business unit. Option C (User identity information) is also correct because the framework enriches events with identity attributes like user name, email, department, and role, enabling risk scoring and correlation. Options B, D, and E are not part of the framework's enrichment: encrypted packet captures are raw network data, raw web server application logs are source events rather than enrichment lookups, and system performance statistics are metrics not typically provided by asset or identity lookups.

Answer

Encrypted packet captures

Answer

Raw web server application logs

Answer

System performance statistics

Question 4

Which TWO factors influence an object's final risk score in Splunk ES?

Accepted Answer

Individual risk event scores. In Splunk Enterprise Security, an object's final risk score is derived from the individual risk events associated with that object, so option C is correct because each contributing risk event carries its own risk score that feeds into the object's overall score. Option D is also correct because the aggregation method configured for the risk framework — such as sum, average, or max — determines how those individual risk event scores are combined into the final object risk score. Options A and B are incorrect because the number of users in the organization and the total disk space of the index are unrelated to risk score computation. Option E is incorrect because the host's operating system does not factor into how Splunk ES calculates an object's risk score.

Answer

The number of users in the organization

Answer

The total disk space of the index

Answer

The operating system of the host

Question 5

Which THREE actions are part of the 'Incident Review' investigation workflow?

Accepted Answer

Changing the status of a notable. In the Incident Review investigation workflow, changing the status of a notable (C) is correct because analysts must move notables through states such as New, In Progress, Pending, Resolved, or Closed to reflect the investigation's progress. Triage of new notable events (D) is correct because the workflow begins by reviewing and prioritizing newly generated notables to determine which require investigation. Assigning notables to an analyst (E) is correct because ownership assignment ensures accountability and routes each notable to the appropriate person for follow-up. Updating system configuration files (A) is not part of the investigation workflow; that is a configuration/administration task, not an incident review action. Rebooting indexer nodes (B) is also not part of the workflow; it is an infrastructure maintenance operation unrelated to reviewing or triaging notables.

Answer

Updating system configuration files

Answer

Rebooting indexer nodes

Question 6

Which TWO metrics are tracked in the 'Incident Review' dashboard's 'Notable Event' list?

Accepted Answer

Severity. In the 'Incident Review' dashboard's 'Notable Event' list, the tracked metrics include Severity (option A), which indicates the priority or impact level assigned to each notable event, and Status (option D), which reflects the current state of the event such as open, acknowledged, or closed. These two fields are standard columns in the notable events table because they help analysts triage and manage incidents efficiently. Raw file path (option B) is not a metric shown in that list; it pertains to file-level details elsewhere. Cluster replication factor (option C) is a storage or indexer configuration setting, not an incident metric. License expiration date (option E) is an administrative licensing detail, unrelated to the notable event list.

Answer

Raw file path

Answer

Cluster replication factor

Answer

License expiration date

Question 7

Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?

Accepted Answer

Risk Message. In the Risk Analysis adaptive response action, the Risk Object (D) specifies which entity type the risk is applied to, such as a user, host, or IP address, making it a required configurable field. The Risk Score (C) sets the numeric risk value (typically 0–100) that the action assigns to that object, which is the core purpose of the action. The Risk Message (B) provides a descriptive text string explaining why the risk was assigned, and it is also configurable within the action. CPU core count (A) and network interface speed (E) are hardware/resource parameters unrelated to risk analysis and cannot be set in this adaptive response action.

Answer

CPU core count

Answer

Network interface speed

Question 8

Which TWO areas of the Splunk ES environment are used to manage risk-based alerting configurations?

Accepted Answer

Risk Analysis configuration. Risk Analysis configuration (A) is correct because it is the Splunk ES area where you define and tune risk framework settings such as risk scores, risk objects, and risk index/threshold behavior used by risk-based alerting. The Correlation Search Editor (D) is also correct because RBA relies on correlation searches to generate risk events, and this editor is where you configure the search logic, risk annotations, and risk message/score actions that feed the risk framework. The License Master UI (B) only handles licensing and does not configure RBA behavior. The Knowledge Object Manager (C) is a general object-management interface, not the dedicated RBA configuration area. The Data Model Acceleration UI (E) manages acceleration for data models and is unrelated to defining risk-based alerting configurations.

Answer

License Master UI

Answer

Knowledge Object Manager

Answer

Data Model Acceleration UI

Question 9

A SOC analyst is reviewing a notable event in Splunk Enterprise Security that was generated from a correlation search firing against a risk index. The analyst wants to see the individual risk events that contributed to the notable's risk score, including the contributing risk rules and their individual risk scores. Which action should the analyst take?

Accepted Answer

Open the Notable Event in the Incident Review dashboard and use the Risk Event drilldown to view the contributing risk events.. The Risk Event drilldown available from the Incident Review dashboard is purpose-built to expose the individual risk events that aggregate into a notable's risk score. It shows each contributing risk rule, the risk object, and the associated risk score, enabling the analyst to understand the composition of the notable and investigate the root causes efficiently within Splunk Enterprise Security.

Answer

Review the ES Audit dashboard to identify which correlation searches recently fired and generated risk events.

Answer

Use the Threat Intelligence framework to correlate the notable's source IP against known threat indicators.

Answer

Run a search against the risk index filtering by the notable's event ID to retrieve the associated risk events.

Question 10

An analyst is reviewing a notables queue in Splunk Enterprise Security and wants to understand why a particular correlation search generated a high-severity finding. The analyst opens the finding in Incident Review and notices the severity is set to 'high', but the contributing risk score is only 40. Which component of the correlation search configuration most directly determines the severity displayed on the finding?

Accepted Answer

The 'severity' field defined in the correlation search's alert settings. A finding's severity is explicitly set by the correlation search that creates it, independent of the underlying risk score. When a notable shows high severity but a modest risk score, the explanation is that the correlation search's alert settings define severity directly. Analysts should inspect the correlation search configuration rather than assume severity is derived from risk score.

Answer

The risk score of the contributing risk events, which always maps directly to severity

Answer

The urgency field in the finding's Notable event attributes

Answer

The default severity assigned by the Risk Analysis data model's risk object

Question 11

A SOC analyst is building a risk-based alerting workflow and wants to ensure that a specific risk rule only contributes to an entity's risk score when the entity is a user account, not a system or IP address. Which configuration in the risk rule's search definition accomplishes this?

Accepted Answer

Set the 'risk_object_type' field to 'user' in the risk event. Risk events carry a risk_object_type field that declares whether the risk applies to a user, system, or other entity. Setting it to 'user' ensures the rule only contributes to user risk scores. Filtering on fields or choosing a data model does not constrain the entity type, and zeroing scores still generates unwanted risk events.

Answer

Set the 'risk_score' field to zero for non-user entities

Answer

Configure the risk rule to use the 'Identity' data model as its primary source

Answer

Add a where clause filtering on the 'user' field being non-null

Question 12

A security analyst receives a notable event about suspicious PowerShell execution on a workstation. To gather more context, the analyst wants to see all events related to the involved host from the last 24 hours in a single view. Which Splunk ES feature provides this consolidated timeline of activity for an entity?

Accepted Answer

Asset Investigator. Asset Investigator is designed to show a unified timeline of events and risk activity for a specific asset, making it ideal for examining all recent activity on a host. Other ES features like Incident Review, Threat Intelligence, and Risk Analysis serve different purposes and do not provide the same consolidated entity view.

Answer

Incident Review

Answer

Threat Intelligence framework

Answer

Risk Analysis dashboard

Question 13

A SOC analyst is reviewing a notable event for a suspected compromised host. The analyst wants to enrich the investigation by viewing the raw event that triggered the detection, along with the associated risk events and threat intelligence matches, directly from the notable event in Splunk Enterprise Security. Which feature should the analyst use to access this consolidated context?

Accepted Answer

Incident Review. Incident Review is designed for investigating notables and provides a unified view of the raw event, risk events, and threat intelligence. It enables analysts to pivot to related evidence, which is essential for effective triage. The other options are supporting features but do not offer the consolidated investigative context required.

Answer

Threat Intelligence Framework

Answer

Asset & Identity Management

Answer

Risk Analysis Dashboard

Question 14

A risk analyst notices that a particular risk rule is generating an excessive number of risk events for low-severity activities, causing alert fatigue. The analyst wants to reduce the impact of this rule on overall risk scores without disabling it entirely. What is the most appropriate action?

Accepted Answer

Modify the risk rule's risk score value to a lower number in the risk rule configuration.. Lowering the risk score value in the risk rule configuration directly reduces the rule's contribution to risk scores, mitigating alert fatigue while preserving detection. Other options either do not affect risk scoring or remove visibility entirely. This is the precise method for tuning risk-based alerting.

Answer

Disable the risk rule temporarily and monitor the impact.

Answer

Change the risk index retention period to reduce storage consumption.

Answer

Add a throttle to the correlation search to limit the number of alerts per hour.

Question 15

A SOC manager is defining a new risk-based alerting strategy and wants to ensure that risk events generated by correlation searches are properly attributed and actionable. Which TWO fields are required in a risk event for the Risk Analysis framework to correctly associate risk with an entity and contribute to its score? (Choose two.)

Accepted Answer

risk_object_type. For the Risk Analysis framework to associate a risk event with an entity and update its score, the event must include risk_object and risk_object_type. These fields identify the entity and its category. Other fields like risk_score, risk_message, and risk_severity are useful but optional for the association to occur.

Answer

risk_message

Answer

risk_score

Answer

risk_severity