SPLK-5001 SIEM Defenses And Data Practices Practice Test 2 — 15 Questions

Question 1

A SOC analyst is onboarding a new firewall log source into Splunk Enterprise Security. The firewall logs must be mapped to the Network_Traffic data model so that correlation searches and dashboards can use them. The analyst has already created the necessary field aliases in props.conf. Which additional configuration is required to make the data model acceleration include these logs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the data model's root event search to include the new source type.. For data model acceleration to include new log sources, the data model's root event search must be updated to capture those events. Field aliases alone do not affect which events are accelerated; they only map field names. The root search defines the dataset, so adding the new source type there ensures the firewall logs are incorporated into the Network_Traffic data model and become available for correlation searches and dashboards.

Answer

Add the source type to the data model's acceleration whitelist in the Data Model Editor.

Answer

Modify the firewall logs' sourcetype to match an existing Network_Traffic source type.

Answer

Create a new tag for the firewall logs and add it to the Network_Traffic data model.

Question 2

A security analyst notices that a Risk Framework entry for a user is not increasing the risk score despite multiple notable events being generated for that user. The notable events are correctly mapped to the user, but the risk score remains unchanged. Which configuration should the analyst verify first to resolve this issue?

Accepted Answer

The risk rules in the Risk Framework are properly configured with the correct risk object and risk score.. Risk scores for users are updated through risk rules defined in the Risk Framework. If notable events are generated but risk scores remain unchanged, the most likely cause is that the risk rules are not correctly configured to map the user as a risk object with an associated risk score. Verifying the risk rules ensures that the user is properly associated and that the score is applied as intended.

Answer

The correlation search schedule is set to run every minute.

Answer

The Risk Analysis adaptive response action is enabled in the correlation search.

Answer

The notable event's urgency is set to High or Critical.

Question 3

A security team wants to create a correlation search that identifies when a user account is locked out and then successfully logs in within 10 minutes. They need to correlate events from the same user across two different indexes: 'wineventlog' for lockout events and 'linux_secure' for login events. Which Splunk ES feature should they use to join these events based on the user field and time window?

Accepted Answer

Splunk ES Correlation Search with the 'correlation' command using the user field and a time window.. The correlation command in Splunk ES is purpose-built for correlating events across indexes by grouping on a field and applying time windows. It efficiently handles the join logic and integrates with the notable event framework, making it the correct choice for detecting multi-step attack patterns like lockout then login.

Answer

Splunk ES Correlation Search with a join subsearch using the user field.

Answer

Splunk ES Asset and Identity framework to enrich user data.

Answer

Transaction search command with startswith and endswith options.

Question 4

A security analyst notices that a correlation search configured to detect multiple failed logins followed by a successful login is not generating notable events, even though the raw events are present in the 'auth' index. The search uses the 'stats' command to count failures by user and then filters for counts greater than 5. Upon reviewing the search, you find that the search is scheduled to run every 5 minutes with a time range of 'Last 5 minutes'. What is the most likely reason for the missing notables?

Accepted Answer

The search uses a time range of 'Last 5 minutes' and runs every 5 minutes, causing events to fall outside the search window due to index lag.. The correlation search runs every 5 minutes over the last 5 minutes, leaving no overlap. Indexing latency can cause events to be missed if they arrive after the search window. To fix this, increase the time range to overlap, such as 'Last 10 minutes' while running every 5 minutes, ensuring events are captured even with lag.

Answer

The correlation search is missing a throttle configuration, causing it to skip execution.

Answer

The 'stats' command is not supported in correlation searches.

Answer

The correlation search is not enabled in the ES configuration.

Question 5

An analyst is tuning Splunk Enterprise Security to reduce alert noise. A correlation search generates a notable event for every failed login from a single source IP, but the security team only wants to see these events when more than 10 failures occur within 5 minutes from the same IP. Which feature should the analyst configure to meet this requirement?

Accepted Answer

Notable event suppression with a throttle based on the src field. Notable event suppression with a throttle on the src field is the correct feature because it allows the correlation search to limit notable generation based on a field value. By configuring suppression, the analyst can ensure that after the first notable, subsequent events from the same source IP are suppressed for a specified period. This reduces noise. While it doesn't enforce a count threshold by itself, it is the mechanism to control when notables appear, and combined with a search that counts events, it achieves the goal. Other options do not directly address the need to conditionally generate notables based on event frequency.

Answer

Risk analysis framework with a risk score threshold

Answer

Adaptive response action to automatically block the source IP

Answer

Correlation search scheduling with a cron expression that runs every 5 minutes

Question 6

A security operations center (SOC) uses Splunk Enterprise Security to monitor for brute-force attacks. An analyst creates a correlation search that detects more than 10 failed login attempts from a single source IP within 5 minutes. The search runs every 10 minutes but fails to trigger notable events consistently. The analyst suspects that the search's time window and schedule are misaligned. Which adjustment should the analyst make to ensure reliable detection?

Accepted Answer

Change the search schedule to run every 5 minutes.. For a correlation search with a 5-minute time window, scheduling the search to run every 5 minutes ensures that each execution covers a non-overlapping 5-minute interval. This alignment prevents gaps where events might be missed and avoids overlapping data that could cause duplicate or inconsistent results. Therefore, adjusting the schedule to match the time window is the correct fix.

Answer

Add a throttle to the search to limit the number of notable events.

Answer

Enable the search to run in real-time mode.

Answer

Increase the time window to 10 minutes to match the schedule.

Question 7

A security analyst is investigating a potential insider threat. They need to create a correlation search that detects when a user account is added to a privileged group and then, within 10 minutes, that same user logs into a critical server. The data comes from two indexes: 'wineventlog' for group changes and 'linux_secure' for logins. Which Splunk ES feature should be used to correlate these events across indexes and time?

Accepted Answer

Correlation search with a time-based correlation rule. Splunk ES correlation searches support time-based correlation rules that can join events from different indexes within a specified time frame. This allows detection of sequences like a privileged group addition followed by a login. By using a correlation search, the analyst can generate a notable event when the pattern is detected, enabling further investigation. Other methods like transaction or join searches lack the native time-window and notable event integration.

Answer

Join search

Answer

Data model acceleration

Answer

Transaction search

Question 8

A security analyst is investigating a potential data exfiltration incident. They need to correlate events from multiple indexes: 'firewall', 'proxy', and 'endpoint'. The analyst wants to create a single search that returns all events from these indexes where the destination IP is in a watchlist of known malicious IPs. Which Splunk search command should be used to efficiently combine these indexes and filter by the watchlist?

Accepted Answer

index=firewall OR index=proxy OR index=endpoint | lookup malicious_ips dest_ip OUTPUT threat_match | where threat_match="true". The lookup command is the most efficient way to enrich events from multiple indexes with watchlist data and filter based on a match. It avoids subsearch limitations, scales well, and allows additional fields from the lookup to be used for context. The other options either use subsearches, join, or incorrect syntax, which are less efficient or invalid. Therefore, the search using lookup is the correct choice for correlating events and filtering by a watchlist.

Answer

index=firewall OR index=proxy OR index=endpoint | search dest_ip IN (malicious_ips)

Answer

index=firewall OR index=proxy OR index=endpoint [inputlookup malicious_ips | fields dest_ip]

Answer

index=firewall OR index=proxy OR index=endpoint | join dest_ip [inputlookup malicious_ips]

Question 9

A security analyst is configuring a correlation search in Splunk Enterprise Security that must generate notable events with specific fields for use in the Incident Review dashboard. The analyst needs to ensure that the notable event includes the 'src' and 'dest' fields from the original event. Which two actions should the analyst take to include these fields in the notable event? (Choose two.)

Accepted Answer

Use the `sendalert` command with the `notable` action and specify the fields in the `param` argument.. To include specific fields such as 'src' and 'dest' in a notable event, the correlation search must first produce those fields in its results. Then, the `sendalert` command with the `notable` action must be used, passing the fields as parameters (e.g., `param.src`, `param.dest`). This ensures the fields are stored with the notable event and displayed in the Incident Review dashboard. Simply having the fields in the search results is not enough; they must be explicitly passed to the notable action.

Answer

Use the `eval` command to rename the fields to 'src' and 'dest' before the `sendalert` command.

Answer

Configure the correlation search to use the `collect` command to store the fields in a summary index.

Answer

Add the fields to the correlation search's alert action configuration in the ES UI.

Question 10

A security analyst is configuring data ingestion for Splunk Enterprise Security. They need to ensure that data from various sources is properly normalized and mapped to the Common Information Model (CIM). Which two actions are required to enable CIM compliance for a new data source? (Choose two.)

Accepted Answer

Ensure the data model is accelerated.. To enable CIM compliance for a new data source, you must create field aliases to map vendor-specific fields to the CIM expected fields, and you must ensure the relevant data model is accelerated for performance and availability. Field aliases perform the actual normalization, while acceleration ensures that the normalized data is efficiently searchable. Other actions like installing the CIM add-on, creating indexes, or defining event types are either prerequisites or optional and not specific to the per-source normalization process.

Answer

Define event types for the data source.

Answer

Install the Splunk Common Information Model add-on.

Answer

Create a new index for the data source.

Question 11

A security analyst is investigating a high-severity notable event in Splunk Enterprise Security. The analyst wants to add a comment to the notable event and assign it to a specific team for further investigation. Which feature in the Incident Review dashboard allows the analyst to perform these actions?

Accepted Answer

The 'Notable Event' details panel.. In the Incident Review dashboard, clicking on a notable event opens its details panel, which provides comprehensive options for managing the event. This includes adding comments, changing the event's status, setting the owner, and assigning it to a team. The details panel is designed for in-depth investigation and collaboration, making it the correct choice for these actions.

Answer

The 'Edit' button on the notable event row.

Answer

The 'Bulk Actions' menu after selecting the notable event.

Answer

The 'Event Actions' dropdown menu.

Question 12

A security analyst is configuring a new correlation search in Splunk Enterprise Security that must use the Risk Framework to assign risk to entities. The analyst wants the search to dynamically update risk scores for users and systems based on suspicious activity. Which TWO actions are required to ensure the correlation search correctly contributes to the Risk Framework? (Choose two.)

Accepted Answer

Configure the correlation search to use the `risk` command to assign risk to entities, specifying the risk object, risk score, and risk message.. To contribute to the Risk Framework, a correlation search must use the `risk` command to assign risk scores to entities, and it must be enabled and scheduled to run regularly. The `risk` command ensures that risk data is written in the required format, while scheduling ensures continuous updates. Visualizing on a dashboard or using other commands does not directly update risk scores.

Answer

Set the correlation search's alert type to 'Risk Notable' to automatically assign risk.

Answer

Configure the correlation search to write results to the 'risk' index using the `collect` command.

Answer

Add the correlation search to the 'Risk Analysis' dashboard to visualize risk scores.

Question 13

You are troubleshooting an 'Adaptive Response' action that is failing to execute on a remote device. What should you check first?

Accepted Answer

Connectivity and credentials in the specific Add-on configuration.. When an Adaptive Response action fails to execute on a remote device, the first thing to check is connectivity and credentials in the specific add-on configuration, because Adaptive Response actions rely on the add-on to connect to the remote device using configured credentials. Without proper connectivity and valid credentials, the action cannot execute.

Answer

The indexer cluster master status.

Answer

The number of active users in Splunk.

Answer

The notable event retention policy.

Question 14

Which Splunk Enterprise Security feature allows you to manage the lifecycle of a notable event?

Accepted Answer

Incident Review.. Incident Review is the Splunk Enterprise Security workbench where analysts triage, assign, comment on, and change the status of notable events (e.g., New, In Progress, Resolved, Closed). It is the primary UI for managing the full lifecycle of a notable event, including ownership, urgency, and disposition. The other features serve different purposes: suppression prevents creation, risk analysis scores entities, and asset/identity investigation enriches context.

Answer

Asset and Identity Investigation.

Answer

Notable Event Suppression.

Answer

Risk Analysis Dashboard.

Question 15

When onboarding a new firewall source, you notice that the data is not populating the 'Network Traffic' data model. What is the most efficient first step to troubleshoot the CIM mapping?

Accepted Answer

Use the CIM Validator app to check compliance against the data model.. The CIM Validator app is specifically designed to validate whether indexed data is correctly mapped to the Common Information Model (CIM) data models, including Network Traffic. It provides detailed reports on missing or misconfigured fields, making it the most efficient first troubleshooting step. This directly identifies CIM mapping gaps without disruptive changes.

Answer

Disable and re-enable the Enterprise Security app.

Answer

Change the sourcetype to 'cisco_asa' manually.

Answer

Re-index all firewall logs from the past 30 days.