SPLK-5001 SIEM Defenses And Data Practices — 10 Questions

Question 1

You are troubleshooting an 'Adaptive Response' action that is failing to execute on a remote device. What should you check first?

Accepted Answer

Connectivity and credentials in the specific Add-on configuration.. The Splunk Add-on for the device must be configured with correct credentials and network connectivity must be verified between the Splunk instance and the device.

Answer

The indexer cluster master status.

Answer

The number of active users in Splunk.

Answer

The notable event retention policy.

Question 2

Which Splunk Enterprise Security feature allows you to manage the lifecycle of a notable event?

Accepted Answer

Incident Review.. The Incident Review dashboard provides the interface for managing statuses, owners, and comments for notable events.

Answer

Asset and Identity Investigation.

Answer

Notable Event Suppression.

Answer

Risk Analysis Dashboard.

Question 3

When onboarding a new firewall source, you notice that the data is not populating the 'Network Traffic' data model. What is the most efficient first step to troubleshoot the CIM mapping?

Accepted Answer

Use the CIM Validator app to check compliance against the data model.. Using the CIM Validator app or running a search with the 'datamodel' command allows you to verify if the fields match the CIM requirements.

Answer

Disable and re-enable the Enterprise Security app.

Answer

Change the sourcetype to 'cisco_asa' manually.

Answer

Re-index all firewall logs from the past 30 days.

Question 4

Where should you perform the initial configuration of the Splunk Common Information Model (CIM) to ensure data is correctly normalized for Enterprise Security?

Accepted Answer

Settings > CIM Setup.. The CIM Setup page in the Splunk Web interface is the primary location for managing CIM data models and accelerations.

Answer

The local/inputs.conf file.

Answer

Splunk ES > Configure > Data Enrichment.

Answer

Settings > Data Model acceleration.

Question 5

You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?

Accepted Answer

Use the 'owner' field in the notable event action configuration to map to an extracted user field.. The 'drilldown_field' and 'owner' field mapping in the notable event configuration allow for dynamic assignment based on extracted fields.

Answer

Assign the owner via a post-process lookup file.

Answer

Create separate correlation searches for each user.

Answer

Hardcode the owner name in the correlation search action.

Question 6

When using the 'Risk Analysis' framework in Splunk ES, what is the primary benefit of assigning a 'Risk Object'?

Accepted Answer

It allows the system to aggregate disparate alerts onto a single entity.. Assigning a risk object (like a user or system) allows for the aggregation of multiple low-fidelity alerts into a single actionable risk score.

Answer

It automatically blocks the user from the network.

Answer

It increases the search performance.

Answer

It deletes the original notable event.

Question 7

A correlation search is failing to generate notable events due to a time-zone mismatch in the source data. What is the best way to handle this in Splunk?

Accepted Answer

Set the TZ attribute in props.conf for the specific sourcetype.. Configuring the time zone in props.conf using TZ ensures that the _time field correctly reflects the event's actual time before correlation.

Answer

Modify the data model acceleration schedule.

Answer

Use an eval statement in the search to subtract hours.

Answer

Change the Splunk server time zone.

Question 8

You are configuring a new Data Model for use with Splunk Enterprise Security. Which action is required to ensure the data model accelerates correctly for use in notable event generation?

Accepted Answer

Enable acceleration and define a summary range.. Acceleration must be enabled and the summary range must be set to cover the retention period required for security investigations.

Answer

Configure the data model to use only indexed fields.

Answer

Set the data model to root-level permissions only.

Answer

Manually create tags for every field in the data model.

Question 9

What is the purpose of the 'Assets and Identities' framework in Splunk ES?

Accepted Answer

To provide context like department and role to security events.. This framework enriches events with contextual information such as business unit, ownership, and priority.

Answer

To manage user passwords.

Answer

To store audit logs for compliance.

Answer

To define the network topology.

Question 10

Which search command is used to join threat intelligence data with your local search results?

Accepted Answer

lookup. The 'lookup' command is the standard way to join event data with external or KV store-based threat intelligence.

Answer

join

Answer

map

Answer

append