SPLK-5001 Multiple Select — 30 Questions

Question 1

You are reviewing the data ingestion pipeline for Splunk Enterprise Security. To ensure that the CIM (Common Information Model) is correctly applied to your data, which two actions are required when configuring a new data source? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply the appropriate tags to the data source or fields.. To make a new data source CIM-compliant, you must map vendor-specific fields to CIM field names using field aliases and apply the correct tags to associate events with the appropriate data models. These two actions ensure that the data is normalized and included in the CIM, enabling correlation searches and other ES features to work correctly.

Answer

Create a new event type that tags the relevant fields.

Answer

Enable data model acceleration for all data models.

Answer

Create a new index for the data source.

Question 2

Which THREE attributes are commonly used to filter notable events in the Incident Review dashboard?

Accepted Answer

Owner.. In the Incident Review dashboard, notable events are triaged using the fields that describe the state and assignment of each notable, so Owner (B) is correct because filtering by owner lets analysts isolate the notables assigned to a specific person or team. Status (C) is correct because notables carry review states such as New, In Progress, Pending, Resolved, and Closed, and filtering by status is a primary way to find unreviewed or open items. Urgency (E) is correct because urgency (Critical, High, Medium, Low, Informational) is a core notable attribute used to prioritize and filter the highest-priority incidents. License type (A) is not a notable-event attribute but a Splunk deployment/licensing property, and index name (D) is an underlying data-source detail rather than a standard Incident Review filter attribute.

Answer

License type.

Answer

Index name.

Question 3

A SOC manager is configuring a new correlation search in Splunk ES to detect potential data exfiltration. The search should trigger a notable event and also automatically create a ticket in the organization's ticketing system via a third-party API. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Configure a custom alert action that sends a REST API call to the ticketing system.. To generate a notable event, the correlation search must have the notable event action enabled. To create a ticket via API, a custom alert action that makes the API call must be configured and added to the search's alert actions. These two actions together fulfill the requirements.

Answer

Create a saved search that runs the correlation search and sends an email.

Answer

Enable the risk analysis framework to assign a risk score to the user.

Answer

Set up a data model acceleration for the index containing the exfiltration data.

Question 4

A Splunk ES analyst is investigating a potential ransomware incident. Which TWO of the following are valid indicators of ransomware activity that should be prioritized for detection? (Choose two.)

Accepted Answer

A sudden increase in SMB write operations to a single file server from multiple hosts. Ransomware's core behaviors are mass file encryption and lateral spread, often via SMB. Detecting high-volume file renames with ransomware extensions and spikes in SMB writes to shared servers directly targets these behaviors, providing actionable alerts. Other options are either unrelated or too nonspecific to prioritize.

Answer

A single failed login attempt from an external IP address

Answer

An increase in DNS queries for known cryptocurrency mining pools

Answer

A user reporting slower than usual workstation performance

Question 5

An attacker has gained access to a workstation and is attempting to move laterally within the network. Which TWO of the following techniques are commonly used for lateral movement that you should monitor in Splunk ES? (Choose two.)

Accepted Answer

Remote Desktop Protocol (RDP) hijacking. Lateral movement involves techniques that allow an attacker to move from one compromised system to another within a network. Pass-the-Hash and RDP hijacking are both established methods for achieving this. SQL injection, XSS, and phishing are attack types that target different stages: SQL injection and XSS are web application attacks, and phishing is an initial access vector. Thus, only Pass-the-Hash and RDP hijacking are correct.

Answer

Phishing

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 6

Which THREE diagnostic tools or logs are useful for troubleshooting a malfunctioning correlation search?

Accepted Answer

The 'notable' index logs.. The 'notable' index logs (A) are useful because correlation searches generate notable events that are written to the notable index, so inspecting it reveals whether the search fired and what it produced. scheduler.log (C) is essential because it records the scheduling of correlation searches, including skipped, deferred, or failed runs and any errors thrown during execution. The Search Job Inspector (E) is useful because it exposes the exact SPL executed, search duration, and detailed execution costs/errors, helping pinpoint why a correlation search misbehaves. The Splunk License usage report (B) only shows indexing volume against license limits and does not diagnose search logic or scheduling failures, and the user's web browser cache (D) is a client-side artifact unrelated to server-side correlation search execution.

Answer

The Splunk License usage report.

Answer

The user's web browser cache.

Question 7

Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?

Accepted Answer

Risk Message. In the Risk Analysis adaptive response action, the Risk Object (D) specifies which entity type the risk is applied to, such as a user, host, or IP address, making it a required configurable field. The Risk Score (C) sets the numeric risk value (typically 0–100) that the action assigns to that object, which is the core purpose of the action. The Risk Message (B) provides a descriptive text string explaining why the risk was assigned, and it is also configurable within the action. CPU core count (A) and network interface speed (E) are hardware/resource parameters unrelated to risk analysis and cannot be set in this adaptive response action.

Answer

CPU core count

Answer

Network interface speed

Question 8

An analyst is investigating a suspected credential dumping attack on a Windows host. They want to identify evidence of this activity in Splunk ES. Which TWO of the following are valid indicators of credential dumping that can be found in Splunk ES data? (Choose two.)

Accepted Answer

Presence of a file named “lsass.dmp” in a temp directory. Credential dumping involves extracting credentials from memory or files. Access to lsass.exe with suspicious access rights indicates an attempt to read its memory, where credentials are stored. The creation of a file named lsass.dmp is a direct artifact of dumping the lsass process memory. Both indicators are observable in Splunk ES via endpoint data models and are strong evidence of credential dumping activity.

Answer

Anomalous number of failed logon attempts

Answer

Creation of a new service with a random name

Answer

Unexpected modification of the hosts file

Question 9

You are aligning your Splunk ES deployment with the NIST Cybersecurity Framework (CSF) to improve your organization's security posture. The CSF Core consists of five functions: Identify, Protect, Detect, Respond, and Recover. Which TWO of the following Splunk ES capabilities most directly support the 'Respond' function? (Choose two.)

Accepted Answer

Incident review and collaboration tools. The Respond function of the NIST CSF focuses on taking action after a security event is detected. Splunk ES's incident review and collaboration tools facilitate investigation and coordination, while adaptive response actions enable automated containment and mitigation. Together, these capabilities directly support the Respond function by streamlining incident handling and executing response measures.

Answer

Asset and identity correlation for context enrichment

Answer

Threat intelligence framework for ingesting indicators

Answer

Risk analysis dashboard for prioritizing vulnerabilities

Question 10

You are hunting for DNS-based data exfiltration using Splunk, where malware encodes stolen data in subdomain labels of queries to an attacker-controlled domain. Which two search constructs most directly help you quantify abnormally long or high-entropy query names and identify the destination domain being abused? (Choose two.)

Accepted Answer

Use rex to extract the query name into a field, then apply eval len() on the query and stats avg(len) by query to find unusually long names.. DNS exfiltration hides data in the length and variability of subdomain labels, so the strongest hunting constructs extract the query name and quantify its length and the number of unique subdomains per parent domain. Ranking parent domains by these metrics exposes the destination being abused and separates tunneling from ordinary resolution traffic without depending on pre-existing threat intelligence.

Answer

Use the lookup command with a threat intelligence feed of known malicious IP addresses and drop every DNS event whose source is not in the feed.

Answer

Use the dedup command on the query field to remove repeated queries and then count the remaining events per host to determine exfiltration volume.

Answer

Use the transaction command to group all DNS events from a single source IP over a 30-minute window into one event and inspect the raw payload.

Question 11

Which TWO types of events are typically categorized as 'Notable Events'?

Accepted Answer

Manually created incidents in Incident Review.. Option B is correct because manually created incidents in Incident Review are user-generated notable events; when an analyst creates an incident in Splunk Enterprise Security's Incident Review, it is stored as a notable event in the notable index and tracked through the investigation workflow. Option D is correct because correlation searches are the primary mechanism that generates notable events in Splunk ES; when a correlation search's triggering condition is met, it writes a notable event to the notable index for review in Incident Review. Option A is incorrect because the license master produces licensing-related internal messages (e.g., license violations or pool usage warnings), not notable events. Option C is incorrect because ordinary log events received by the indexer are raw indexed data, not notable events, unless a correlation search or manual action promotes them. Option E is incorrect because a user's browser history is endpoint/web data that would only become notable if a correlation search flagged it, not by its nature.

Answer

Events produced by the license master.

Answer

Every log event received by the indexer.

Answer

Browser history of a user.

Question 12

Which TWO types of data are commonly enriched by the Asset and Identity framework?

Accepted Answer

Host/Asset context. The Asset and Identity framework in Splunk ES is designed to correlate events with contextual metadata about hosts and users, so option A (Host/Asset context) is correct because it enriches events with asset attributes such as IP, MAC, hostname, priority, and business unit. Option C (User identity information) is also correct because the framework enriches events with identity attributes like user name, email, department, and role, enabling risk scoring and correlation. Options B, D, and E are not part of the framework's enrichment: encrypted packet captures are raw network data, raw web server application logs are source events rather than enrichment lookups, and system performance statistics are metrics not typically provided by asset or identity lookups.

Answer

Encrypted packet captures

Answer

Raw web server application logs

Answer

System performance statistics

Question 13

Which THREE components are required for an Adaptive Response action to function?

Accepted Answer

The Adaptive Response action must be enabled.. Option A is correct because an Adaptive Response action must be explicitly enabled in the Splunk ES configuration before it can be triggered; a disabled action will never execute even if all other prerequisites are met. Option C is correct because Adaptive Response actions that reach out to external systems (for example, running a script or invoking a third-party API) require validated credentials for the target system so the action can authenticate and perform its task. Option E is correct because a properly configured add-on for the target system is needed to provide the integration, capabilities, and supporting binaries or scripts that the Adaptive Response action relies on. Option B is not required because Adaptive Response actions operate within the customer's environment and do not need a permanent Internet connection. Option D is not required because the 'Admin' role on all indexers is not a prerequisite for an Adaptive Response action to function; the necessary permissions relate to the action and its target, not to indexer-wide admin rights.

Answer

A permanent connection to the Internet.

Answer

A user with 'Admin' role on all indexers.

Question 14

Which TWO areas of the Splunk ES environment are used to manage risk-based alerting configurations?

Accepted Answer

Risk Analysis configuration. Risk Analysis configuration (A) is correct because it is the Splunk ES area where you define and tune risk framework settings such as risk scores, risk objects, and risk index/threshold behavior used by risk-based alerting. The Correlation Search Editor (D) is also correct because RBA relies on correlation searches to generate risk events, and this editor is where you configure the search logic, risk annotations, and risk message/score actions that feed the risk framework. The License Master UI (B) only handles licensing and does not configure RBA behavior. The Knowledge Object Manager (C) is a general object-management interface, not the dedicated RBA configuration area. The Data Model Acceleration UI (E) manages acceleration for data models and is unrelated to defining risk-based alerting configurations.

Answer

License Master UI

Answer

Knowledge Object Manager

Answer

Data Model Acceleration UI

Question 15

Which THREE of the following represent valid ways to use the 'lookup' command?

Accepted Answer

lookup file.csv field1. Option A is correct because the basic syntax of the lookup command is `lookup

`, so `lookup file.csv field1` is a valid minimal invocation that matches field1 in the CSV against the event field of the same name. Option C is correct because the lookup command supports renaming the input field with `AS` and specifying output fields with `OUTPUT ... AS ...`, so `lookup file.csv field1 AS field_a OUTPUT field2 AS field_b` is valid syntax. Option D is correct because `lookup file.csv field1 OUTPUT field2` is the standard form for matching field1 and returning only field2 from the lookup table. Option B is not valid because `--all` is not a recognized lookup command flag; there is no such option to return all fields. Option E is not valid because `--join` is not a lookup command parameter; lookup does not use a join flag (joins are performed with the `join` command).

Answer

lookup file.csv --all

Answer

lookup file.csv --join

Question 16

Which TWO of the following are valid methods to mitigate an insider threat within Splunk ES?

Accepted Answer

Enabling RBA for high-risk users. Option C is correct because Splunk Enterprise Security's Risk-Based Alerting (RBA) aggregates risk scores from risk modifiers and anomaly detections into risk index entries, allowing analysts to prioritize and investigate high-risk users whose cumulative risk exceeds defined thresholds — directly surfacing insider behavior that might otherwise go unnoticed. Option D is correct because Correlation Searches in Splunk ES run on schedules against indexed data and can trigger notable events when patterns such as large outbound data transfers, unusual download volumes, or access to sensitive indexes indicate potential data exfiltration by an insider. The remaining options are not valid Splunk ES mitigations: disabling all network ports (A) would break the Splunk deployment itself and is not a security control, manually logging all user keystrokes (B) is an endpoint/DLP function outside Splunk ES and raises privacy/legal issues, and deleting user accounts immediately (E) is a reactive, destructive action that destroys audit evidence rather than a mitigation method within Splunk ES.

Answer

Disabling all network ports

Answer

Manually logging all user keystrokes

Answer

Deleting user accounts immediately

Question 17

Which TWO of the following are key components of the Splunk ES Threat Intelligence framework?

Accepted Answer

Threat Source management. Option A (Threat Source management) is correct because the Splunk ES Threat Intelligence framework relies on configuring threat sources (such as local CSV lookups, threat intelligence feeds, or TAXII/STIX integrations) to ingest and normalize indicators of compromise into the system. Option E (Threat Intelligence collections) is correct because collections are the core construct that groups related threat intelligence data (e.g., IPs, domains, file hashes) and maps them to intelligence sources for use in correlation searches and adaptive response. Forwarder management (B) belongs to Splunk deployment/server administration for data collection, not the threat intelligence framework. Dashboard customization (C) is a general UI/presentation feature and not a structural component of the TI framework. Incident classification (D) relates to incident review and notable event workflow in ES, but it is not one of the key components that define the Threat Intelligence framework itself.

Answer

Forwarder management

Answer

Dashboard customization

Answer

Incident classification

Question 18

Which TWO factors influence an object's final risk score in Splunk ES?

Accepted Answer

Individual risk event scores. In Splunk Enterprise Security, an object's final risk score is derived from the individual risk events associated with that object, so option C is correct because each contributing risk event carries its own risk score that feeds into the object's overall score. Option D is also correct because the aggregation method configured for the risk framework — such as sum, average, or max — determines how those individual risk event scores are combined into the final object risk score. Options A and B are incorrect because the number of users in the organization and the total disk space of the index are unrelated to risk score computation. Option E is incorrect because the host's operating system does not factor into how Splunk ES calculates an object's risk score.

Answer

The number of users in the organization

Answer

The total disk space of the index

Answer

The operating system of the host

Question 19

When designing a threat hunting playbook, which TWO components must be included to ensure the hunt is actionable?

Accepted Answer

Detailed SPL search queries. Option C is correct because a threat hunting playbook must contain detailed SPL (Search Processing Language) queries so analysts can actually execute the hunt against SIEM data in Splunk and pivot on the specific fields, indicators, or behaviors being sought; without concrete queries the hunt is theoretical rather than actionable. Option E is correct because incident response escalation steps define what happens when a hunt uncovers malicious activity — who is notified, within what timeframe, and through which channels — which converts a detection into a coordinated, actionable response rather than an unaddressed finding. Options A, B, and D do not belong: the security department budget is a management concern, not a hunt execution component; a network topology map can provide useful context but is not a required element for making a hunt actionable; and a list of all employees is an HR/PII inventory that does not drive hunt execution or escalation.

Answer

The budget for the security department

Answer

A copy of the company's network topology map

Answer

A list of all employees in the company

Question 20

Which THREE things are required for Splunk Enterprise Security to provide meaningful security insights?

Accepted Answer

Contextual Asset and Identity information.. Option B is correct because Splunk Enterprise Security relies on asset and identity lookups (via the Asset and Identity framework, populated through CSV lookups or identity management) to enrich events with ownership, priority, and user context, which is essential for risk scoring, correlation searches, and notable event triage. Option C is correct because ES correlation searches and data models depend on the Common Information Model (CIM), so raw data must be normalized into CIM-compliant data models (e.g., Authentication, Network_Traffic, Endpoint) using field aliases, tags, and calculated fields for meaningful detections. Option D is correct because ES can only analyze data that is properly indexed and parsed—correct sourcetypes, timestamps, and field extractions are prerequisites before CIM mapping and correlation can occur. Option A is not required; ES works with a single Splunk deployment and does not need a separate instance per sourcetype, as multiple sourcetypes are indexed together. Option E is not required because Splunk Enterprise Security is a software application that runs on supported hardware or virtualized/cloud infrastructure, not a dedicated appliance.

Answer

A separate Splunk instance for every sourcetype.

Answer

A dedicated hardware appliance.