SPLK-5001 SIEM Defenses And Data Practices Practice Test 3 — 15 Questions

Question 1

Which TWO factors directly impact the urgency of a notable event in Splunk ES?

Accepted Answer

The risk score of the event.. Urgency is calculated by combining the event's inherent risk score and the criticality of the system or user (asset) involved.

Answer

The color scheme of the dashboard.

Answer

The total volume of indexed events.

Answer

The number of active users in the system.

Question 2

Which THREE components are required for an Adaptive Response action to function?

Accepted Answer

The Adaptive Response action must be enabled.. Adaptive response requires an enabled action, a configured Add-on (for the target system), and proper credentials.

Answer

A permanent connection to the Internet.

Answer

A user with 'Admin' role on all indexers.

Question 3

Which TWO ways can you enrich events with threat intelligence in Splunk ES?

Accepted Answer

Using the 'lookup' command against a KV Store collection.. Threat intel can be added via the 'Threat Intelligence' framework (using KV Store lookups) or by using standard 'lookup' commands against threat feeds.

Answer

By changing the user's password.

Answer

By editing the indexer's configuration files.

Answer

By deleting the old notable events.

Question 4

Which THREE attributes are commonly used to filter notable events in the Incident Review dashboard?

Accepted Answer

Owner.. Analysts typically filter by status, urgency, and owner to manage their incident queue.

Answer

License type.

Answer

Index name.

Question 5

Which TWO actions should be taken if a correlation search is consuming too many system resources?

Accepted Answer

Reduce the search frequency (cron schedule).. Optimizing the search query and reducing the search frequency (cron) are the primary ways to reduce resource impact.

Answer

Re-install the Splunk Enterprise application.

Answer

Delete all historical data.

Answer

Switch to a different operating system.

Question 6

Which THREE things are required for Splunk Enterprise Security to provide meaningful security insights?

Accepted Answer

Contextual Asset and Identity information.. Success requires indexed data, normalized data (CIM), and contextual information (Assets/Identities).

Answer

A separate Splunk instance for every sourcetype.

Answer

A dedicated hardware appliance.

Question 7

Which TWO types of events are typically categorized as 'Notable Events'?

Accepted Answer

Manually created incidents in Incident Review.. Notable events are usually generated by high-fidelity correlation searches or by manual user creation in the Incident Review dashboard.

Answer

Events produced by the license master.

Answer

Every log event received by the indexer.

Answer

Browser history of a user.

Question 8

Which THREE diagnostic tools or logs are useful for troubleshooting a malfunctioning correlation search?

Accepted Answer

The 'notable' index logs.. Scheduler logs, search job inspector, and the internal notable event index are all key to diagnosing search failures.

Answer

The Splunk License usage report.

Answer

The user's web browser cache.

Question 9

Which TWO factors are critical for effective Asset and Identity enrichment?

Accepted Answer

The consistency of the source data files.. The quality of the input data (CSV/KV Store) and the accuracy of the matching fields (like IP or user) are critical.

Answer

The physical location of the Splunk indexer.

Answer

The number of colors used in the dashboard.

Answer

The version of the OS running on the search head.

Question 10

You are onboarding a new Windows Event Log source using the Splunk Universal Forwarder. To ensure the data conforms to the Splunk Common Information Model (CIM) for the Authentication data model, where should you primarily configure the sourcetype?

Accepted Answer

The input configuration within the Splunk Add-on for Microsoft Windows.. To ensure CIM compliance, data should be mapped to the appropriate CIM tags and fields. Configuring the sourcetype correctly in props.conf and transforms.conf (or via the Add-on Builder) ensures the data is parsed and tagged into the Authentication data model correctly.

Answer

The data model acceleration settings in the ES app settings.

Answer

The index-time index routing configuration in indexes.conf.

Answer

The Notable Event Suppression configuration in Splunk ES.

Question 11

A security analyst needs to reduce the noise generated by a specific correlation search that triggers too frequently for authorized internal vulnerability scanners. What is the most efficient way to handle this in Splunk ES?

Accepted Answer

Use the Notable Event Suppression feature within the Incident Review dashboard.. Notable event suppression allows analysts to define criteria where events matching specific patterns (like a known scanner IP) are ignored, preventing them from appearing as notable events.

Answer

Disable the correlation search and create a new one with an exclusion filter.

Answer

Modify the search logic to use an 'eval' statement to filter out the scanner IP address.

Answer

Change the risk score of the notable event to zero in the correlation search configuration.

Question 12

You are troubleshooting why a specific Correlation Search is not appearing in the Incident Review dashboard despite the search returning results. What is the most likely cause?

Accepted Answer

The 'Notable' adaptive response action is not enabled in the search configuration.. The 'Notable' adaptive response action must be enabled in the correlation search configuration for it to generate an entry in the Incident Review dashboard.

Answer

The correlation search schedule is set to 'Real-time'.

Answer

The user does not have the 'ess_admin' role.

Answer

The data model acceleration is lagging.

Question 13

Which component in the Splunk ES architecture is responsible for mapping disparate log sources to a unified schema?

Accepted Answer

Common Information Model (CIM) Add-on. The Splunk Common Information Model (CIM) is the framework that provides the schema for normalizing data across various sources.

Answer

Notable Event Suppression

Answer

Splunk Enterprise Security App

Answer

Splunk Indexer

Question 14

When configuring a risk-based correlation search, what is the primary purpose of the 'Risk Analysis' adaptive response action?

Accepted Answer

To attribute risk to a specific object, such as a user or system.. The Risk Analysis action adds risk events to the Risk Index, which allows for the aggregation of multiple low-fidelity alerts into a high-fidelity risk score for a specific entity.

Answer

To purge malicious events from the index.

Answer

To notify the SOC manager via email.

Answer

To automatically block the offending IP address on the firewall.

Question 15

A security engineer is configuring a new correlation search that needs to correlate data across two different indexes. Which Splunk ES feature allows for efficient correlation across large datasets?

Accepted Answer

Data Model Acceleration. Data model acceleration allows Splunk to pre-calculate and store data models, making correlation searches run significantly faster than raw searches across indices.

Answer

Summary Indexing

Answer

Correlation Search Tuning

Answer

Lookup file generation