SPLK-5001 SIEM Defenses And Data Practices Practice Test 3 — 15 Questions

Question 1

You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'owner' field in the notable event action configuration to map to an extracted user field.. The Notable adaptive response action in a correlation search includes an 'owner' configuration field where you can specify a token or field name (e.g., $user$ or $src_user$) that Splunk ES will resolve per-result. This means each triggered notable event gets its owner dynamically assigned based on the extracted user field from that specific result, correctly distributing ownership across multiple distinct users.

Answer

Assign the owner via a post-process lookup file.

Answer

Create separate correlation searches for each user.

Answer

Hardcode the owner name in the correlation search action.

Question 2

When using the 'Risk Analysis' framework in Splunk ES, what is the primary benefit of assigning a 'Risk Object'?

Accepted Answer

It allows the system to aggregate disparate alerts onto a single entity.. In Splunk ES Risk Analysis, a Risk Object is the entity (user, system, IP, or other) to which risk is attributed. Assigning a Risk Object lets the framework aggregate risk scores from many different correlation searches and notable events onto that single entity, so analysts see a consolidated risk posture rather than isolated alerts. This aggregation is the core value of risk-based alerting.

Answer

It automatically blocks the user from the network.

Answer

It increases the search performance.

Answer

It deletes the original notable event.

Question 3

A correlation search is failing to generate notable events due to a time-zone mismatch in the source data. What is the best way to handle this in Splunk?

Accepted Answer

Set the TZ attribute in props.conf for the specific sourcetype.. The TZ attribute in props.conf tells Splunk how to interpret timestamps in a sourcetype when the source data lacks an explicit time zone or uses a non-default one. Setting TZ = <timezone> for the specific sourcetype ensures _time is calculated correctly at index time, so correlation searches evaluate events against the correct time window. This is the canonical, supported fix for time-zone mismatches in source data.

Answer

Modify the data model acceleration schedule.

Answer

Use an eval statement in the search to subtract hours.

Answer

Change the Splunk server time zone.

Question 4

You are configuring a new Data Model for use with Splunk Enterprise Security. Which action is required to ensure the data model accelerates correctly for use in notable event generation?

Accepted Answer

Enable acceleration and define a summary range.. To use a data model for notable event generation in ES, you must enable acceleration and define a summary range, because ES correlation searches rely on accelerated data models for performance. Acceleration creates summary data that the data model can query quickly, and the summary range determines how far back the summaries are retained.

Answer

Configure the data model to use only indexed fields.

Answer

Set the data model to root-level permissions only.

Answer

Manually create tags for every field in the data model.

Question 5

What is the purpose of the 'Assets and Identities' framework in Splunk ES?

Accepted Answer

To provide context like department and role to security events.. The Assets and Identities framework in Splunk ES enriches security events with contextual metadata such as department, role, priority, and location by correlating event fields (e.g., src, dest, user) against lookup tables. This context helps analysts prioritize and understand the business impact of detections.

Answer

To manage user passwords.

Answer

To store audit logs for compliance.

Answer

To define the network topology.

Question 6

Which search command is used to join threat intelligence data with your local search results?

Accepted Answer

lookup. The lookup command is the standard SPL command for enriching local search results with external data, including threat intelligence lookups. It matches fields in the event stream against a lookup table (CSV, KV Store, or external) and returns additional fields, making it the correct tool for joining threat intel with local results.

Answer

join

Answer

map

Answer

append

Question 7

A user reports that a specific dashboard panel is timing out. After checking the search job, you notice it is scanning too much data. Which configuration should you adjust?

Accepted Answer

Optimize the search query and use data model summaries.. A dashboard panel timing out because it scans too much data is a search efficiency problem, not a resource or configuration limit problem. Optimizing the SPL (narrowing the time range, filtering early, using tstats) and leveraging accelerated data model summaries drastically reduces the data scanned and returns results within the panel's timeout window. This addresses the root cause rather than masking the symptom.

Answer

Increase the 'max_search_results' in limits.conf.

Answer

Increase the memory for the Splunk web server.

Answer

Re-install the Splunk app.

Question 8

You are creating a custom Adaptive Response action. The action requires a Python script. Where must this script be placed for the Splunk instance to execute it?

Accepted Answer

$SPLUNK_HOME/etc/apps//bin. Custom Adaptive Response actions in Splunk ES that use a Python script require the script to be placed in the 'bin' directory of the app that defines the action, i.e., $SPLUNK_HOME/etc/apps//bin. This is where Splunk looks for executable scripts associated with the app.

Answer

The root of the Splunk installation directory.

Answer

/etc/system/bin

Answer

/var/lib/splunk/scripts

Question 9

You want to suppress a specific correlation search alert for a legitimate vulnerability scan. What is the most precise way to achieve this without disabling the search?

Accepted Answer

Create a Notable Event Suppression entry.. Notable Event Suppression entries in Splunk ES allow you to filter out specific notable events from triggering alerts or appearing in the Incident Review dashboard based on field values (e.g., matching a vulnerability scanner's signature or source). This is the most precise method because it targets only the specific events you want to suppress while leaving the correlation search fully operational for all other detections.

Answer

Lower the urgency of the notable event.

Answer

Modify the correlation search cron schedule.

Answer

Delete the scan data from the index.

Question 10

When configuring a correlation search, what does the 'Notable Event' field 'Urgency' determine?

Accepted Answer

The priority ranking in the Incident Review dashboard.. In Splunk Enterprise Security, the 'Urgency' field on a notable event is a normalized severity indicator (informational, low, medium, high, critical) that drives the priority ranking and sort order within the Incident Review dashboard. It is populated by the correlation search's adaptive response action (e.g., 'risk' or 'notable' action) based on the 'urgency' argument set in the saved search. It does not affect scheduling, retention, or execution speed — those are governed by other settings.

Answer

The frequency at which the search runs.

Answer

The retention period of the event.

Answer

The speed of the correlation search execution.

Question 11

What is the primary function of the 'Notable Event Suppression' feature?

Accepted Answer

To reduce alert fatigue from known false positives.. Notable Event Suppression in Splunk ES lets analysts suppress future notables that match specified fields (e.g., same src, dest, rule name) for a defined period. Its primary purpose is to reduce alert fatigue by filtering out known false positives or already-investigated recurring activity, so the SOC focuses on genuinely new threats. Suppression does not block traffic or modify correlation search performance.

Answer

To automatically block malicious IPs.

Answer

To speed up correlation searches.

Answer

To archive old notable events.

Question 12

When troubleshooting a missing notable event, which search should you run to verify if the correlation search is producing results?

Accepted Answer

Run the search query logic manually in the Search app.. Running the correlation search's SPL logic manually in the Search app is the definitive way to verify whether the underlying query returns events. If the raw search produces results but no notable event appears, the problem lies in the alert action, throttling, or suppression configuration rather than the search logic itself. This isolates the search engine behavior from the correlation search scheduling and alerting pipeline.

Answer

index=notable

Answer

Check the 'scheduler.log'.

Answer

Re-index the source data.

Question 13

Which Splunk ES dashboard allows you to view and manage active threat intelligence feeds?

Accepted Answer

Threat Intelligence Manager.. The Threat Intelligence Manager dashboard in Splunk Enterprise Security is specifically designed to view, add, and manage threat intelligence feeds. It provides a centralized interface for configuring feeds, monitoring their status, and reviewing the threat objects they contain. This dashboard directly supports the threat intelligence framework, allowing analysts to enable or disable feeds and adjust settings.

Answer

Security Posture.

Answer

Asset and Identity.

Answer

Incident Review.

Question 14

You are configuring a 'Notable Event' to use a specific 'Drilldown' link. What syntax is used to pass fields from the event into the URL?

Accepted Answer

$field_name$. In Splunk Enterprise Security notable event drilldown configuration, token substitution uses the dollar-sign syntax $field_name$ to inject field values from the triggering event into the drilldown URL. This is the same token syntax used throughout Splunk dashboards and is the documented format for ES drilldown links. The tokens are replaced at render time with the actual field values from the notable event.

Answer

{field_name}

Answer

%field_name%

Answer

[field_name]

Question 15

When a notable event is generated, where does the 'Risk Score' value originate?

Accepted Answer

From the correlation search's defined risk factor.. The Risk Score on a notable event originates from the risk factor defined in the correlation search that generated it. When a correlation search is configured, it specifies a risk score (risk_score) and risk object; that score is attached to the risk event and, when thresholds are crossed, contributes to the notable's risk score. Thus the correlation search's defined risk factor is the source.

Answer

From the number of events in the result set.

Answer

From the indexer's CPU load.

Answer

From the user's login history.