SPLK-5001 Quick Quiz — 10 Questions

Question 1

You are reviewing the data ingestion pipeline for Splunk Enterprise Security. To ensure that the CIM (Common Information Model) is correctly applied to your data, which two actions are required when configuring a new data source? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply the appropriate tags to the data source or fields.. To make a new data source CIM-compliant, you must map vendor-specific fields to CIM field names using field aliases and apply the correct tags to associate events with the appropriate data models. These two actions ensure that the data is normalized and included in the CIM, enabling correlation searches and other ES features to work correctly.

Answer

Create a new event type that tags the relevant fields.

Answer

Enable data model acceleration for all data models.

Answer

Create a new index for the data source.

Question 2

If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?

Accepted Answer

Splunk Index Manager interface.. The 'risk' index is a standard Splunk index, so its retention (frozenTimePeriodInSecs) is managed through the Splunk Index Manager interface (Settings > Indexes in Splunk Web, or indexes.conf). ES does not override index retention through its own app settings, so the Index Manager is the correct place to modify retention for the risk index.

Answer

ES app settings.

Answer

Data model acceleration settings.

Answer

Correlation Search Editor.

Question 3

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

Accepted Answer

Correlation Search Editor. Risk rule weights are defined as part of the correlation search definition itself, so the weight is edited in the Correlation Search Editor within Enterprise Security. The editor exposes the risk analysis configuration, including the risk object fields and the risk score/weight assigned when the search fires. Changing the weight anywhere else would not affect how the correlation search writes risk events.

Answer

Identity Manager

Answer

Risk Index Configuration

Answer

Risk Notable Settings

Question 4

A SOC analyst is reviewing a notable event in Splunk Enterprise Security that was generated from a correlation search firing against a risk index. The analyst wants to see the individual risk events that contributed to the notable's risk score, including the contributing risk rules and their individual risk scores. Which action should the analyst take?

Accepted Answer

Open the Notable Event in the Incident Review dashboard and use the Risk Event drilldown to view the contributing risk events.. The Risk Event drilldown available from the Incident Review dashboard is purpose-built to expose the individual risk events that aggregate into a notable's risk score. It shows each contributing risk rule, the risk object, and the associated risk score, enabling the analyst to understand the composition of the notable and investigate the root causes efficiently within Splunk Enterprise Security.

Answer

Review the ES Audit dashboard to identify which correlation searches recently fired and generated risk events.

Answer

Use the Threat Intelligence framework to correlate the notable's source IP against known threat indicators.

Answer

Run a search against the risk index filtering by the notable's event ID to retrieve the associated risk events.

Question 5

A Splunk ES analyst is tuning a correlation search that generates a large number of false positives. The analyst wants to reduce noise without disabling the search entirely. The search currently uses a risk rule that assigns a risk score of 20 to each matching event. Which approach best aligns with risk-based alerting best practices?

Accepted Answer

Adjust the search's risk rule to assign a lower risk score and add a filter to exclude known benign activity.. Tuning a noisy risk rule should involve refining the detection logic to exclude benign activity and adjusting the risk score to reflect the rule's true severity. This reduces false positives without sacrificing detection coverage. Simply raising the score, throttling, or disabling the search either fails to address the root cause or removes detection capability. The best practice is to iteratively tune the risk rule based on observed false positives.

Answer

Increase the risk score to 100 so that only high-risk events trigger notables.

Answer

Add a throttle to the correlation search to suppress duplicate notable events.

Answer

Disable the correlation search and create a new one with a different name.

Question 6

Which THREE attributes are commonly used to filter notable events in the Incident Review dashboard?

Accepted Answer

Owner.. In the Incident Review dashboard, notable events are triaged using the fields that describe the state and assignment of each notable, so Owner (B) is correct because filtering by owner lets analysts isolate the notables assigned to a specific person or team. Status (C) is correct because notables carry review states such as New, In Progress, Pending, Resolved, and Closed, and filtering by status is a primary way to find unreviewed or open items. Urgency (E) is correct because urgency (Critical, High, Medium, Low, Informational) is a core notable attribute used to prioritize and filter the highest-priority incidents. License type (A) is not a notable-event attribute but a Splunk deployment/licensing property, and index name (D) is an underlying data-source detail rather than a standard Incident Review filter attribute.

Answer

License type.

Answer

Index name.

Question 7

You are troubleshooting why a specific Correlation Search is not appearing in the Incident Review dashboard despite the search returning results. What is the most likely cause?

Accepted Answer

The 'Notable' adaptive response action is not enabled in the search configuration.. For a correlation search's results to appear in Incident Review, the search must include the 'Notable' adaptive response action in its configuration. Without this action enabled, the search runs and returns results, but no notable events are written to the notable index, so Incident Review shows nothing. This is the most common cause of 'search fires but no notables appear.'

Answer

The correlation search schedule is set to 'Real-time'.

Answer

The user does not have the 'ess_admin' role.

Answer

The data model acceleration is lagging.

Question 8

A SOC manager is configuring a new correlation search in Splunk ES to detect potential data exfiltration. The search should trigger a notable event and also automatically create a ticket in the organization's ticketing system via a third-party API. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Configure a custom alert action that sends a REST API call to the ticketing system.. To generate a notable event, the correlation search must have the notable event action enabled. To create a ticket via API, a custom alert action that makes the API call must be configured and added to the search's alert actions. These two actions together fulfill the requirements.

Answer

Create a saved search that runs the correlation search and sends an email.

Answer

Enable the risk analysis framework to assign a risk score to the user.

Answer

Set up a data model acceleration for the index containing the exfiltration data.

Question 9

When troubleshooting a missing notable event, which search should you run to verify if the correlation search is producing results?

Accepted Answer

Run the search query logic manually in the Search app.. Running the correlation search's SPL logic manually in the Search app is the definitive way to verify whether the underlying query returns events. If the raw search produces results but no notable event appears, the problem lies in the alert action, throttling, or suppression configuration rather than the search logic itself. This isolates the search engine behavior from the correlation search scheduling and alerting pipeline.

Answer

index=notable

Answer

Check the 'scheduler.log'.

Answer

Re-index the source data.

Question 10

A Splunk ES analyst is investigating a potential ransomware incident. Which TWO of the following are valid indicators of ransomware activity that should be prioritized for detection? (Choose two.)

Accepted Answer

A sudden increase in SMB write operations to a single file server from multiple hosts. Ransomware's core behaviors are mass file encryption and lateral spread, often via SMB. Detecting high-volume file renames with ransomware extensions and spikes in SMB writes to shared servers directly targets these behaviors, providing actionable alerts. Other options are either unrelated or too nonspecific to prioritize.

Answer

A single failed login attempt from an external IP address

Answer

An increase in DNS queries for known cryptocurrency mining pools

Answer

A user reporting slower than usual workstation performance