SPLK-5001 SIEM Defenses And Data Practices — 20 Questions

Question 1

You are troubleshooting an 'Adaptive Response' action that is failing to execute on a remote device. What should you check first?

Accepted Answer

Connectivity and credentials in the specific Add-on configuration.. The Splunk Add-on for the device must be configured with correct credentials and network connectivity must be verified between the Splunk instance and the device.

Answer

The indexer cluster master status.

Answer

The number of active users in Splunk.

Answer

The notable event retention policy.

Question 2

Which Splunk Enterprise Security feature allows you to manage the lifecycle of a notable event?

Accepted Answer

Incident Review.. The Incident Review dashboard provides the interface for managing statuses, owners, and comments for notable events.

Answer

Asset and Identity Investigation.

Answer

Notable Event Suppression.

Answer

Risk Analysis Dashboard.

Question 3

When onboarding a new firewall source, you notice that the data is not populating the 'Network Traffic' data model. What is the most efficient first step to troubleshoot the CIM mapping?

Accepted Answer

Use the CIM Validator app to check compliance against the data model.. Using the CIM Validator app or running a search with the 'datamodel' command allows you to verify if the fields match the CIM requirements.

Answer

Disable and re-enable the Enterprise Security app.

Answer

Change the sourcetype to 'cisco_asa' manually.

Answer

Re-index all firewall logs from the past 30 days.

Question 4

Where should you perform the initial configuration of the Splunk Common Information Model (CIM) to ensure data is correctly normalized for Enterprise Security?

Accepted Answer

Settings > CIM Setup.. The CIM Setup page in the Splunk Web interface is the primary location for managing CIM data models and accelerations.

Answer

The local/inputs.conf file.

Answer

Splunk ES > Configure > Data Enrichment.

Answer

Settings > Data Model acceleration.

Question 5

You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?

Accepted Answer

Use the 'owner' field in the notable event action configuration to map to an extracted user field.. The 'drilldown_field' and 'owner' field mapping in the notable event configuration allow for dynamic assignment based on extracted fields.

Answer

Assign the owner via a post-process lookup file.

Answer

Create separate correlation searches for each user.

Answer

Hardcode the owner name in the correlation search action.

Question 6

When using the 'Risk Analysis' framework in Splunk ES, what is the primary benefit of assigning a 'Risk Object'?

Accepted Answer

It allows the system to aggregate disparate alerts onto a single entity.. Assigning a risk object (like a user or system) allows for the aggregation of multiple low-fidelity alerts into a single actionable risk score.

Answer

It automatically blocks the user from the network.

Answer

It increases the search performance.

Answer

It deletes the original notable event.

Question 7

A correlation search is failing to generate notable events due to a time-zone mismatch in the source data. What is the best way to handle this in Splunk?

Accepted Answer

Set the TZ attribute in props.conf for the specific sourcetype.. Configuring the time zone in props.conf using TZ ensures that the _time field correctly reflects the event's actual time before correlation.

Answer

Modify the data model acceleration schedule.

Answer

Use an eval statement in the search to subtract hours.

Answer

Change the Splunk server time zone.

Question 8

You are configuring a new Data Model for use with Splunk Enterprise Security. Which action is required to ensure the data model accelerates correctly for use in notable event generation?

Accepted Answer

Enable acceleration and define a summary range.. Acceleration must be enabled and the summary range must be set to cover the retention period required for security investigations.

Answer

Configure the data model to use only indexed fields.

Answer

Set the data model to root-level permissions only.

Answer

Manually create tags for every field in the data model.

Question 9

What is the purpose of the 'Assets and Identities' framework in Splunk ES?

Accepted Answer

To provide context like department and role to security events.. This framework enriches events with contextual information such as business unit, ownership, and priority.

Answer

To manage user passwords.

Answer

To store audit logs for compliance.

Answer

To define the network topology.

Question 10

Which search command is used to join threat intelligence data with your local search results?

Accepted Answer

lookup. The 'lookup' command is the standard way to join event data with external or KV store-based threat intelligence.

Answer

join

Answer

map

Answer

append

Question 11

A user reports that a specific dashboard panel is timing out. After checking the search job, you notice it is scanning too much data. Which configuration should you adjust?

Accepted Answer

Optimize the search query and use data model summaries.. Adjusting the time range picker or optimizing the search by using specific indexes or summaries will reduce scan volume.

Answer

Increase the 'max_search_results' in limits.conf.

Answer

Increase the memory for the Splunk web server.

Answer

Re-install the Splunk app.

Question 12

You are creating a custom Adaptive Response action. The action requires a Python script. Where must this script be placed for the Splunk instance to execute it?

Accepted Answer

$SPLUNK_HOME/etc/apps/<app_name>/bin. The script must be placed in the 'bin' directory of the specific Add-on or app directory to be accessible by the Splunk search process.

Answer

The root of the Splunk installation directory.

Answer

/etc/system/bin

Answer

/var/lib/splunk/scripts

Question 13

You need to ensure that only authorized users can view certain sensitive notable events. How do you implement this in Splunk ES?

Accepted Answer

Create a separate index and assign role-based access.. Data model-based security and index-level access controls are used to restrict visibility to events based on user roles.

Answer

Encrypt the notable events in the KV Store.

Answer

Hide the notable event in the Incident Review dashboard.

Answer

Change the notable event severity to 'Informational'.

Question 14

You want to suppress a specific correlation search alert for a legitimate vulnerability scan. What is the most precise way to achieve this without disabling the search?

Accepted Answer

Create a Notable Event Suppression entry.. Notable Event Suppression allows you to define specific filter criteria based on fields like host, user, or signature to ignore known false positives.

Answer

Lower the urgency of the notable event.

Answer

Modify the correlation search cron schedule.

Answer

Delete the scan data from the index.

Question 15

When configuring a correlation search, what does the 'Notable Event' field 'Urgency' determine?

Accepted Answer

The priority ranking in the Incident Review dashboard.. Urgency is a calculated value based on the risk of the event and the criticality of the assets involved, displayed in the Incident Review dashboard.

Answer

The frequency at which the search runs.

Answer

The retention period of the event.

Answer

The speed of the correlation search execution.

Question 16

Which dashboard in Splunk ES provides a high-level view of threats and vulnerabilities mapped to the MITRE ATT&CK framework?

Accepted Answer

Security Posture.. The Security Posture dashboard and the MITRE ATT&CK mapping dashboard are standard features for viewing framework coverage.

Answer

Asset Discovery.

Answer

Threat Intelligence Manager.

Answer

Incident Review.

Question 17

What is the primary function of the 'Notable Event Suppression' feature?

Accepted Answer

To reduce alert fatigue from known false positives.. It allows users to prevent known false positives from creating notable events, reducing alert fatigue.

Answer

To automatically block malicious IPs.

Answer

To speed up correlation searches.

Answer

To archive old notable events.

Question 18

You need to ensure that the 'Threat Intelligence' framework periodically updates. Where do you configure the update interval?

Accepted Answer

In the Threat Intelligence Manager dashboard.. The Threat Intelligence Manager allows you to define the update interval for individual threat feeds.

Answer

Using a crontab on the OS level.

Answer

By modifying the threat data model.

Answer

In the global settings.conf file.

Question 19

When troubleshooting a missing notable event, which search should you run to verify if the correlation search is producing results?

Accepted Answer

Run the search query logic manually in the Search app.. Running the search query defined in the correlation search manually allows you to see if the search logic is returning any results.

Answer

index=notable

Answer

Check the 'scheduler.log'.

Answer

Re-index the source data.

Question 20

Which Splunk ES dashboard allows you to view and manage active threat intelligence feeds?

Accepted Answer

Threat Intelligence Manager.. The Threat Intelligence Manager is the interface for managing and monitoring external threat feeds.

Answer

Security Posture.

Answer

Asset and Identity.

Answer

Incident Review.