SPLK-5001 Investigation And Risk Management Practice Test 5 — 15 Questions

Question 1

A security analyst is documenting the key phases of a Splunk Enterprise Security investigation workflow for a new team member. Which two phases are essential components of this workflow? (Choose two.)

Accepted Answer

Triage and prioritization of notables based on risk scores and urgency.. Triage and prioritization, and evidence collection and correlation, are core phases of the Splunk Enterprise Security investigation workflow. They ensure analysts focus on high-risk notables and gather necessary context. The other options are either impractical or not part of the standard workflow.

Answer

Immediate escalation of every notable to senior management regardless of severity.

Answer

Regular deletion of all historical notable events to maintain system performance.

Answer

Automated remediation of all detected threats without human intervention.

Question 2

A junior analyst is asked to find all risk events associated with a specific user account to assess potential insider threat activity. Which search command should the analyst use to retrieve these risk events from the risk index?

Accepted Answer

index=risk user=jsmith. Risk events are stored in the risk index, so searching index=risk with a user filter retrieves all relevant risk events. The notable index contains notables, not raw risk events. The risk command generates risk, not retrieves it. Thus, the direct index search is correct.

Answer

| risk user=jsmith

Answer

index=main user=jsmith

Answer

index=notable user=jsmith

Question 3

A SOC analyst is reviewing a notables list in Splunk Enterprise Security and wants to see the individual risk events that contributed to a specific notable's risk score. The analyst opens the notable's detail view and looks for a way to pivot directly to the contributing risk events. Which action should the analyst take?

Accepted Answer

Click the 'Risk Event' link in the notable's detail view to open a search pre-filtered by the notable's risk object.. The Risk Event link in a notable's detail view is the built-in pivot that launches a search against the risk index filtered to the notable's risk object. This lets the analyst immediately see every risk event that contributed to the score, which is essential for understanding why the notable fired. Manually searching the notable index or exporting the notable cannot expose those underlying risk events.

Answer

Export the notable as a PDF and review the embedded risk event table.

Answer

Run a search using the 'from' command against the notable index to retrieve related risk events.

Answer

Use the 'collect' command to copy the notable into the risk index and then search it.

Question 4

An analyst is building a risk rule that assigns a risk score to a user based on the number of failed authentication attempts observed in a 10-minute window. The analyst wants the risk score to increase proportionally with the number of failures, but also wants to avoid generating excessive risk events for every single failure. Which approach best meets these requirements?

Accepted Answer

Calculate a risk score using a formula that multiplies the failure count by a weight, and apply the risk modifier via the risk score field in the correlation search.. To achieve proportionality without event flooding, the correlation search should aggregate failures per user over the window and compute a risk score using a formula that scales with the count. Assigning that computed value as the risk score in a single risk event per user per window meets both goals. Per-event scoring floods the risk index, while static thresholds or fixed-score aggregations lose proportionality.

Answer

Use the 'collect' command to write a single aggregated risk event per user per hour with a fixed score.

Answer

Use a threshold-based correlation search that triggers once when the count exceeds a static threshold.

Answer

Create one correlation search per failed authentication event and assign a fixed risk score to each.

Question 5

A SOC analyst is reviewing an investigation in Splunk Enterprise Security and wants to determine whether a specific threat intelligence indicator has been observed in the environment over the past 90 days. Which investigation technique best supports this requirement?

Accepted Answer

Run a search against the threat intelligence data model and pivot on the indicator to review all associated events across the 90-day window.. Pivoting on an indicator within the threat intelligence data model lets the analyst examine all indexed events associated with that indicator across the retention window. This leverages existing data rather than creating new detections or waiting for future activity. It provides the comprehensive historical view needed to confirm whether the indicator has been observed in the environment during the specified period.

Answer

Create a correlation search that triggers a notable event whenever the indicator appears in the threat intelligence data model.

Answer

Add the indicator to a lookup file and schedule a daily report that lists any matching events from the previous 24 hours.

Answer

Open the Incident Review dashboard and filter notables by the indicator's urgency score to count related findings.

Question 6

A Splunk ES analyst is tuning a correlation search that generates a large number of false positives. The analyst wants to reduce noise without disabling the search entirely. The search currently uses a risk rule that assigns a risk score of 20 to each matching event. Which approach best aligns with risk-based alerting best practices?

Accepted Answer

Adjust the search's risk rule to assign a lower risk score and add a filter to exclude known benign activity.. Tuning a noisy risk rule should involve refining the detection logic to exclude benign activity and adjusting the risk score to reflect the rule's true severity. This reduces false positives without sacrificing detection coverage. Simply raising the score, throttling, or disabling the search either fails to address the root cause or removes detection capability. The best practice is to iteratively tune the risk rule based on observed false positives.

Answer

Increase the risk score to 100 so that only high-risk events trigger notables.

Answer

Add a throttle to the correlation search to suppress duplicate notable events.

Answer

Disable the correlation search and create a new one with a different name.

Question 7

A risk analyst notices that a user account accumulated a high risk score from multiple contributing risk events, but the score does not reflect the expected sum of the individual risk rule weights. Which factor most likely explains the discrepancy?

Accepted Answer

Risk event retention expired for some contributing events, so only events still within the risk index retention window are counted.. An entity's risk score reflects the risk events currently present in the risk index within the relevant scoring window. If some contributing events have exceeded the risk index retention period, they are no longer available to contribute, making the observed score lower than the sum of all rule weights the analyst expects. Retention and scoring window settings therefore directly affect the calculated total.

Answer

Risk scores are normalized against the total number of users in the identity lookup, reducing per-user values.

Answer

The risk score is capped by the maximum risk score threshold configured for the risk index, limiting how high it can climb.

Answer

The risk score is recalculated only when a new notable event is generated, so recent risk events are not yet included.

Question 8

A SOC manager is defining a new risk-based alerting (RBA) strategy in Splunk Enterprise Security. The manager wants to ensure that risk events are properly attributed to the correct entities so that risk scores aggregate accurately. Which two actions should the manager take when configuring risk rules? (Choose two.)

Accepted Answer

Assign a risk score that reflects the severity and confidence of the detection.. Proper RBA configuration requires defining risk objects (such as user, src, dest) so that risk is attributed correctly, and assigning a risk score that reflects the detection's severity and confidence. These two actions ensure that risk events aggregate accurately and that risk scores are meaningful. Generating notables for every event, writing to the notable index, or running infrequently would all disrupt the RBA model and reduce its effectiveness.

Answer

Configure the risk rule to write to the notable index instead of the risk index.

Answer

Enable the risk rule to generate a notable event for every matching event.

Answer

Set the risk rule's schedule to run only once per day to reduce load.

Question 9

A security analyst is documenting the lifecycle of an investigation in Splunk Enterprise Security. Which statement accurately describes how cases and notables relate within that lifecycle?

Accepted Answer

A notable can be added to a case, and a single case can contain multiple notables and associated events.. Cases serve as containers for investigations and can include multiple notables along with related events and artifacts. Analysts add notables to a case to group related findings, enabling coordinated analysis, evidence collection, and documentation. This relationship supports the workflow of triaging individual notables and then consolidating related ones into a single investigative record.

Answer

A case is automatically created for every notable event generated by a correlation search.

Answer

Closing a case automatically closes all notables that were added to it, preventing further review.

Answer

Notables and cases are stored in the same index and are distinguished only by their source type.

Question 10

An analyst is investigating a notable event in Splunk ES and needs to determine which correlation search generated it and what risk objects contributed to its creation. Which Splunk ES feature provides this information directly from the notable event?

Accepted Answer

The Incident Review dashboard's Event Details panel.. The Incident Review dashboard's Event Details panel is designed to show all relevant metadata for a notable event, including the correlation search that generated it and the risk objects that contributed to its risk score. This allows analysts to understand the detection logic and contributing entities without leaving the notable event context. Other options are either for enrichment, aggregate views, or general searching, and do not provide the direct linkage required.

Answer

The Search & Reporting app's default search view.

Answer

The Asset & Identity management interface.

Answer

The Risk Analysis dashboard's Risk Objects pane.

Question 11

A SOC manager is defining requirements for a new detection that should contribute to an entity's risk profile in Splunk Enterprise Security. Which TWO characteristics must the detection have to properly contribute risk to an entity? (Choose two.)

Accepted Answer

The correlation search must be configured to generate a risk event with a defined risk object and risk score.. For a detection to contribute to an entity's risk profile, it must generate a risk event that specifies the affected entity through a risk object and includes a risk score contribution. These two elements allow the platform to attribute risk to the correct entity and adjust its score. Other attributes such as data model acceleration, ATT&CK mapping, or notable generation are optional enhancements, not requirements.

Answer

The detection must be mapped to a MITRE ATT&CK technique to be eligible for risk scoring.

Answer

The detection must create a notable event in addition to any risk event it produces.

Answer

The detection must use a data model that is accelerated to ensure timely risk event generation.

Question 12

A security analyst is investigating a notable in Splunk ES and needs to determine the potential impact of the threat. The analyst wants to correlate the risk object with asset and identity data to understand the criticality of the affected system and the user's role. Which two actions should the analyst take to enrich the investigation with asset and identity context? (Choose two.)

Accepted Answer

Use the Identity Investigator to review the user's role and watchlist status.. To enrich an investigation with asset and identity context, the analyst should use the Asset Investigator to assess system criticality and the Identity Investigator to understand the user's role and watchlist status. These tools pull from the asset and identity lookups, providing immediate context. Searching the risk index or raw events for this information is ineffective because that data is not stored there.

Answer

Run a search against the identity index to find the user's manager and department.

Answer

Use the 'inputlookup' command to query the risk index for asset information.

Answer

Configure a new correlation search to extract asset priority from the notable's raw event.

Question 13

A SOC manager wants to review the overall risk posture of the organization by examining the highest-risk users and systems over the past week. Which Splunk Enterprise Security dashboard provides this aggregated view of risk objects and their scores?

Accepted Answer

Risk Analysis. The Risk Analysis dashboard is designed to display risk scores aggregated by risk object, such as users and systems. It allows security managers to quickly identify which entities have the highest accumulated risk, providing a clear view of organizational risk posture over a selected time range.

Answer

Incident Review

Answer

Security Posture

Answer

Threat Activity

Question 14

During an investigation, an analyst needs to correlate a series of authentication failures with subsequent successful logins from the same source across multiple indexers. Which Splunk Enterprise Security capability is most appropriate for this task?

Accepted Answer

The Authentication data model, which normalizes authentication events and supports pivoting across users, sources, and outcomes.. The Authentication data model normalizes authentication events from diverse sources into a consistent schema with fields for user, source, action, and outcome. This allows analysts to correlate failed and successful authentications from the same source across multiple indexers. It is purpose-built for authentication investigations, unlike network, risk, or web data models that serve different analytic needs.

Answer

The Network Traffic data model, which captures sessions and can reveal authentication attempts embedded in network flows.

Answer

The Risk data model, which aggregates risk events and can show whether authentication failures contributed to an entity's score.

Answer

The Web data model, which captures HTTP activity and can include login attempts to web applications.

Question 15

During an investigation, an analyst determines that a user's risk score is inflated because a single risk rule is firing repeatedly on benign activity. The analyst wants to reduce the impact of this rule on the user's overall risk score without disabling the rule entirely. What is the most appropriate action?

Accepted Answer

Create a risk rule exception or a throttling configuration for the rule so it does not repeatedly add risk for the same user within a time window.. Risk score inflation from a single noisy rule is best handled by throttling or adding an exception so the rule does not repeatedly add risk for the same entity within a defined window. This preserves the rule's value for other entities and scenarios while preventing the specific user from accumulating disproportionate risk from benign activity.

Answer

Edit the risk rule's stanza in `risk_rules.conf` and set the `risk_score` value to a lower number.

Answer

Modify the user's risk score manually in the Risk Analysis dashboard by subtracting points from the current total.

Answer

Change the user's risk object type in the identity lookup so the rule no longer matches the user.