SPLK-5001 SIEM Defenses And Data Practices — 10 Questions

Question 1

Where should you perform the initial configuration of the Splunk Common Information Model (CIM) to ensure data is correctly normalized for Enterprise Security?

Accepted Answer

Settings > CIM Setup.. The CIM Setup page in the Splunk Web interface is the primary location for managing CIM data models and accelerations.

Answer

The local/inputs.conf file.

Answer

Splunk ES > Configure > Data Enrichment.

Answer

Settings > Data Model acceleration.

Question 2

You need to ensure that only authorized users can view certain sensitive notable events. How do you implement this in Splunk ES?

Accepted Answer

Create a separate index and assign role-based access.. Creating a separate index for sensitive notable events and assigning role-based access control (RBAC) ensures only authorized roles can search that index and view the notables. Splunk's index-level permissions are the standard mechanism for restricting data visibility, and notable events stored in that index inherit those restrictions. This is the correct way to enforce access control on sensitive notables.

Answer

Encrypt the notable events in the KV Store.

Answer

Hide the notable event in the Incident Review dashboard.

Answer

Change the notable event severity to 'Informational'.

Question 3

Which dashboard in Splunk ES provides a high-level view of threats and vulnerabilities mapped to the MITRE ATT&CK framework?

Accepted Answer

Security Posture.. The Security Posture dashboard in Splunk ES provides a high-level, executive-friendly view of threats and vulnerabilities mapped to the MITRE ATT&CK framework. It aggregates detections by ATT&CK tactic and technique, showing coverage gaps and overall security posture across the environment. This makes it the correct choice for a framework-mapped threat/vulnerability overview.

Answer

Asset Discovery.

Answer

Threat Intelligence Manager.

Answer

Incident Review.

Question 4

You need to ensure that the 'Threat Intelligence' framework periodically updates. Where do you configure the update interval?

Accepted Answer

In the Threat Intelligence Manager dashboard.. The Threat Intelligence framework's update interval is configured in the Threat Intelligence Manager dashboard, which provides a UI for managing threat source feeds, their download schedules, and parsing settings. This is the supported, documented location for configuring periodic updates.

Answer

Using a crontab on the OS level.

Answer

By modifying the threat data model.

Answer

In the global settings.conf file.

Question 5

Which field is mandatory for an event to be correctly categorized by the Common Information Model (CIM) 'Network Traffic' data model?

Accepted Answer

tag. The 'tag' field is mandatory for an event to be correctly categorized by the CIM Network Traffic data model, because tags are used to associate events with specific data models. Without the appropriate tag (e.g., 'network', 'traffic'), the event will not be mapped to the Network Traffic data model.

Answer

user

Answer

src_ip

Answer

host

Question 6

Which TWO methods can be used to suppress notable events?

Accepted Answer

Directly modifying the 'notable_event_suppression' KV Store collection.. Option D is correct because Splunk Enterprise Security stores suppression rules in the notable_event_suppression KV Store collection, and administrators can directly edit that collection (for example via the KV Store REST endpoint or a lookup editor) to add, modify, or remove suppression entries that prevent matching notable events from being created. Option E is correct because ES ships with the 'Notable Event Suppression' dashboard (under the Incident Review/Configuration area), which provides a supported UI for creating and managing suppression rules that write to the same notable_event_suppression KV Store collection. Option A is incorrect because restarting the search head cluster only redistributes searches and does not alter suppression logic or the suppression collection. Option B is incorrect because renaming an index changes where data is stored and searched, not whether notable events are suppressed. Option C is incorrect because inputs.conf controls data input settings such as sourcetype, host, and index, and has no role in notable event suppression.

Answer

Restarting the search head cluster.

Answer

Renaming the index.

Answer

Adding a block to the inputs.conf.

Question 7

Which THREE actions are necessary to successfully onboard a new data source into Splunk Enterprise Security?

Accepted Answer

Enable data model acceleration.. Option B is correct because Splunk Enterprise Security relies on accelerated data models (such as the Common Information Model and its Authentication, Network_Traffic, etc. models) to populate its correlation searches, dashboards, and risk framework, so enabling data model acceleration is required for the new source's data to be usable by ES. Option D is correct because ES expects data to land in specific indexes (for example, the default 'main' index or a dedicated index defined in the ES index configuration) so that the data model constraints and correlation searches can locate and search the events properly. Option E is correct because ES correlation searches and CIM-based detections depend on event types being tagged with the appropriate CIM tags (e.g., 'authentication', 'network', 'web') so the data is normalized and mapped to the correct data models. Option A is incorrect because disabling other Splunk apps is never required and would break ES functionality, and Option C is incorrect because creating a custom indexer cluster is not a prerequisite for onboarding a data source into ES.

Answer

Disable all other Splunk apps.

Answer

Create a custom indexer cluster.

Question 8

A security analyst needs to reduce the noise generated by a specific correlation search that triggers too frequently for authorized internal vulnerability scanners. What is the most efficient way to handle this in Splunk ES?

Accepted Answer

Use the Notable Event Suppression feature within the Incident Review dashboard.. Notable Event Suppression in Splunk ES is purpose-built to reduce noise from correlation searches that fire on known-good activity, such as authorized internal vulnerability scanners. It allows the analyst to define suppression rules (by field, time window, or rule) directly in the Incident Review dashboard without altering the underlying correlation search logic or risk framework. This preserves detection fidelity for other entities while silencing the specific noisy source.

Answer

Disable the correlation search and create a new one with an exclusion filter.

Answer

Modify the search logic to use an 'eval' statement to filter out the scanner IP address.

Answer

Change the risk score of the notable event to zero in the correlation search configuration.

Question 9

In Splunk ES, where can you manage the 'Risk Threshold' for triggering a Notable Event based on aggregate risk scores?

Accepted Answer

Configure > Data Enrichment > Risk Analysis. In Splunk Enterprise Security, the Risk Analysis framework allows you to define risk thresholds that, when exceeded by an entity's aggregate risk score, automatically generate a notable event. These thresholds are configured under Configure > Data Enrichment > Risk Analysis, where you can create risk rules that specify the threshold value, the risk object type (e.g., system, user), and the severity of the resulting notable event. This is the central place to manage risk-based alerting, not the Incident Review dashboard or correlation searches.

Answer

Incident Review Dashboard

Answer

Configure > Content > Correlation Searches

Answer

The Security Posture dashboard

Question 10

Which THREE of the following are necessary prerequisites for ensuring a new data source is correctly utilized by the ES 'Access' data model?

Accepted Answer

The data must be tagged with the appropriate CIM tags.. Option A is correct because the Splunk Common Information Model (CIM) relies on event tagging — the data must be tagged with the appropriate CIM tags (e.g., tag=authentication, tag=network) so that the Access data model's constraints can match the events. Option C is correct because a data model must be enabled for it to be used in searches (e.g., via the datamodel command or Pivot), and it must be accelerated to populate the summary (tsidx) data that makes the 'Access' data model performant and usable for reporting. Option E is correct because the sourcetype must be mapped to an existing CIM data model through the data model's object constraints (typically via the CIM add-on's sourcetype-to-data-model mapping), which is what associates the incoming data with the Access data model's fields and tags. Option B is not required — data can reside in any index (or multiple indexes) as long as it is tagged and mapped to the CIM; the 'main' index is not a prerequisite. Option D is not required — Splunk indexes events in their native format and extracts fields at search time, so converting data to JSON is not a prerequisite for CIM/data model utilization.

Answer

The data must be sent to the 'main' index.

Answer

The data must be converted to JSON format.