SPLK-5001 Multiple Select — 50 Questions

Question 1

Which THREE of the following are common phases defined in the Cyber Kill Chain model?

Accepted Answer

Reconnaissance. The Cyber Kill Chain consists of Reconnaissance, Weaponization, Delivery, Exploitation, Installation, C2, and Actions on Objectives.

Answer

Containment

Answer

Patching

Question 2

Which THREE of the following represent the categories of threat intelligence that can be managed within the Splunk Enterprise Security 'Threat Intelligence' framework?

Accepted Answer

Domain Names. ES allows for the management of Indicators of Compromise (IoCs) including IP addresses, file hashes, and domain names.

Answer

User Session Tokens

Answer

Network Topology Maps

Question 3

You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?

Accepted Answer

Enablement of the 'Splunk App for CIS Benchmarks'.. To report on CIS benchmarks, you need to collect the configuration data and have a mechanism to compare it against the expected state (the benchmark).

Answer

Configure all logs to use the 'Syslog' protocol only.

Answer

Install a third-party antivirus solution.

Answer

Configure the index to 'Hot/Warm' storage only.

Question 4

You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?

Accepted Answer

Notable Events framework.. The 'Notable Events' framework and 'Correlation Searches' are the primary mechanisms in ES for detecting and surfacing security anomalies.

Answer

Workload Management.

Answer

Data Model acceleration.

Answer

Report acceleration.

Question 5

Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?

Accepted Answer

Detect. The five core functions of NIST CSF are Identify, Protect, Detect, Respond, and Recover.

Answer

Report

Answer

Eradicate

Question 6

Which THREE techniques can be used in Splunk to reduce the noise of false positives during a threat hunt?

Accepted Answer

Using 'NOT' clauses to exclude known administrative processes. Filtering known-good values, using lookup tables for exclusions, and weighting alerts are all standard methods for noise reduction.

Answer

Deleting raw logs after indexing

Answer

Increasing the search time range

Question 7

When hunting for lateral movement, which THREE data sources are most valuable for correlation?

Accepted Answer

Windows Security Event ID 4688 (Process Creation). Authentication logs (4624), process execution (4688), and service installation (7045) provide the necessary context to track an attacker moving between hosts.

Answer

Windows System Event ID 104 (Log Cleared)

Answer

Windows Security Event ID 4611 (Trusted Logon)

Question 8

Which THREE elements are essential for a well-defined risk-based alert?

Accepted Answer

A threshold for notable generation. RBA requires identifying the risk object, assigning a score, and using a correlation search to monitor that risk.

Answer

Manual approval for every alert

Answer

Hardware-level encryption

Question 9

Which TWO actions can be taken on a notable event directly from the Incident Review dashboard?

Accepted Answer

Change the notable event status. Analysts can run adaptive response actions and manage the notable event status directly from this dashboard.

Answer

Modify the correlation search code

Answer

Rebuild the threat intelligence index

Answer

Delete the underlying index

Question 10

Which THREE things are required for Splunk Enterprise Security to provide meaningful security insights?

Accepted Answer

Contextual Asset and Identity information.. Success requires indexed data, normalized data (CIM), and contextual information (Assets/Identities).

Answer

A separate Splunk instance for every sourcetype.

Answer

A dedicated hardware appliance.

Question 11

Which TWO types of data are commonly enriched by the Asset and Identity framework?

Accepted Answer

Host/Asset context. The framework is primarily used to add context to users and hosts (assets).

Answer

Encrypted packet captures

Answer

Raw web server application logs

Answer

System performance statistics

Question 12

Which TWO of the following are common types of social engineering?

Accepted Answer

Pretexting. Phishing and pretexting are classic examples of social engineering techniques.

Answer

Buffer Overflow

Answer

SQL Injection

Answer

Port Scanning

Question 13

Which THREE components are required for an Adaptive Response action to function?

Accepted Answer

The Adaptive Response action must be enabled.. Adaptive response requires an enabled action, a configured Add-on (for the target system), and proper credentials.

Answer

A permanent connection to the Internet.

Answer

A user with 'Admin' role on all indexers.

Question 14

Which TWO ways can you enrich events with threat intelligence in Splunk ES?

Accepted Answer

Using the 'lookup' command against a KV Store collection.. Threat intel can be added via the 'Threat Intelligence' framework (using KV Store lookups) or by using standard 'lookup' commands against threat feeds.

Answer

By changing the user's password.

Answer

By editing the indexer's configuration files.

Answer

By deleting the old notable events.

Question 15

Which THREE of the following are benefits of using Risk-Based Alerting (RBA) in Splunk ES?

Accepted Answer

Improved focus on behavioral indicators. RBA reduces noise, prioritizes high-risk entities, and focuses on behavioral patterns.

Answer

Automatic remediation of threats

Answer

Automatic license management

Question 16

Which THREE of the following data sources are most valuable for detecting an insider threat?

Accepted Answer

Endpoint file activity. Insider threats are best monitored through access logs, file activity, and email traffic.

Answer

Printer toner levels

Answer

Router uptime logs

Question 17

Which TWO of the following are primary indicators of a phishing attack that you should look for in email logs?

Accepted Answer

Suspicious URL in email body. Phishing often uses suspicious sender domains and malicious embedded links.

Answer

Successful authentication

Answer

High CPU usage on server

Answer

Unusual printer activity

Question 18

Which TWO factors influence an object's final risk score in Splunk ES?

Accepted Answer

Individual risk event scores. The final score is influenced by the individual event scores and the aggregation method applied.

Answer

The number of users in the organization

Answer

The total disk space of the index

Answer

The operating system of the host

Question 19

Which THREE pieces of information are commonly found in a Splunk ES Case?

Accepted Answer

Investigation metadata (status, owner). Cases are containers that hold key artifacts, comments from analysts, and links to relevant notable events.

Answer

Raw indexer performance logs

Answer

System health metrics

Question 20

Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?

Accepted Answer

Risk Message. The action allows configuration of the risk object, score, and message.

Answer

CPU core count

Answer

Network interface speed