SPLK-5001 SIEM Defenses And Data Practices Practice Test 4 — 15 Questions

Question 1

What is the effect of changing the 'Retention Period' in the Enterprise Security app settings?

Accepted Answer

It determines how long data remains in the Notable event storage.. The Retention Period setting in Splunk Enterprise Security controls how long notable events and their associated metadata are retained in the notable event storage (the KV Store-backed index). Changing it adjusts the lifespan of these records before they are purged, directly affecting how far back analysts can review or investigate prior notables. It does not affect raw data retention, licensing, or user permissions.

Answer

It changes the user access level.

Answer

It changes the search speed.

Answer

It increases the license limit.

Question 2

Which component of the Splunk Enterprise Security architecture is responsible for generating notable events?

Accepted Answer

The Search Head.. In Splunk Enterprise Security, correlation searches run on the Search Head, and their alert actions (including the 'notable' action) generate notable events. The Search Head is where ES app components — correlation searches, data models, and the notable event framework — execute. Indexers store raw data, forwarders send data, and the License Master manages licensing; none of these generate notables.

Answer

The Forwarder.

Answer

The License Master.

Answer

The Indexer.

Question 3

What is the purpose of the 'Incident Review' dashboard in Splunk ES?

Accepted Answer

To triage and manage notable events.. The Incident Review dashboard in Splunk Enterprise Security is the central triage workspace where analysts review, prioritize, and act on notable events generated by correlation searches. It provides filtering, sorting, and bulk actions so analysts can manage their queue efficiently. This makes 'triage and manage notable events' the correct purpose.

Answer

To manage threat intelligence feeds.

Answer

To configure data model acceleration.

Answer

To view real-time system health.

Question 4

Which THREE tasks are performed within the 'CIM Setup' interface?

Accepted Answer

Mapping sourcetypes to data models.. In the Splunk Common Information Model (CIM) Setup interface, the three core tasks are mapping sourcetypes to data models (B), enabling data model acceleration (C), and verifying mapping compliance (D). Option B is correct because CIM Setup lets you associate event sourcetypes with the appropriate CIM data models so that fields are normalized for apps like Enterprise Security. Option C is correct because the same interface provides checkboxes to enable acceleration on each data model, which builds the summary data needed for fast correlation searches. Option D is correct because CIM Setup includes a validation/verification step that checks whether the mapped sourcetypes actually populate the required CIM fields and flags any compliance gaps. Option A is not part of CIM Setup; index retention policies are configured in indexes.conf or the Indexes settings, not in the CIM Setup UI. Option E is also not part of CIM Setup; user roles and permissions are managed through Splunk authentication and authorization (e.g., Settings > Roles or authorize.conf).

Answer

Configuring index retention policies.

Answer

Defining user roles and permissions.

Question 5

You need to modify the default 'Risk Score' logic for a specific asset. Where should this customization occur?

Accepted Answer

In the 'Risk Scoring' configuration or via lookup tables.. Risk score logic for a specific asset can be customized in the Risk Scoring configuration (via the Risk Analysis framework's settings) or by using lookup tables to override or adjust scores based on asset attributes. This allows per-asset tuning without modifying core ES code.

Answer

By changing the sourcetype definition.

Answer

In the 'limits.conf' file.

Answer

By editing the 'notable_event' python script.

Question 6

Which TWO factors directly impact the urgency of a notable event in Splunk ES?

Accepted Answer

The risk score of the event.. In Splunk Enterprise Security, the urgency of a notable event is calculated from the event's risk score and the criticality of the asset or identity involved, so option C (the risk score of the event) is correct because higher-risk scores raise urgency, and option D (the criticality of the asset involved) is correct because a mission-critical asset increases the urgency of the notable event. These two factors are combined by the urgency calculation (risk score × asset/identity criticality) to produce the urgency level shown on the Incident Review dashboard. Option A is incorrect because dashboard color schemes are purely cosmetic and have no effect on urgency. Option B is incorrect because the total volume of indexed events is a licensing/performance metric, not an urgency input. Option E is incorrect because the number of active users in the system does not factor into the urgency calculation for a notable event.

Answer

The color scheme of the dashboard.

Answer

The total volume of indexed events.

Answer

The number of active users in the system.

Question 7

Which THREE components are required for an Adaptive Response action to function?

Accepted Answer

The Adaptive Response action must be enabled.. Option A is correct because an Adaptive Response action must be explicitly enabled in the Splunk ES configuration before it can be triggered; a disabled action will never execute even if all other prerequisites are met. Option C is correct because Adaptive Response actions that reach out to external systems (for example, running a script or invoking a third-party API) require validated credentials for the target system so the action can authenticate and perform its task. Option E is correct because a properly configured add-on for the target system is needed to provide the integration, capabilities, and supporting binaries or scripts that the Adaptive Response action relies on. Option B is not required because Adaptive Response actions operate within the customer's environment and do not need a permanent Internet connection. Option D is not required because the 'Admin' role on all indexers is not a prerequisite for an Adaptive Response action to function; the necessary permissions relate to the action and its target, not to indexer-wide admin rights.

Answer

A permanent connection to the Internet.

Answer

A user with 'Admin' role on all indexers.

Question 8

Which TWO ways can you enrich events with threat intelligence in Splunk ES?

Accepted Answer

Using the 'lookup' command against a KV Store collection.. Option A is correct because Splunk ES supports enriching events with threat intelligence through the SPL 'lookup' command, which can match event fields against a KV Store collection (such as a threat intel lookup) to append context like threat matches or risk scores. Option D is correct because the Threat Intelligence Manager in Splunk ES is the built-in interface for configuring and managing threat intelligence feeds, which download and normalize indicators that are then used to enrich events via lookups. Option B is incorrect because changing a user's password is an authentication/account action and has no role in threat intelligence enrichment. Option C is incorrect because editing indexer configuration files is not a supported or practical method for enriching events with threat intelligence in Splunk ES. Option E is incorrect because deleting old notable events is a data retention/cleanup action and does not add threat intelligence context to events.

Answer

By changing the user's password.

Answer

By editing the indexer's configuration files.

Answer

By deleting the old notable events.

Question 9

Which THREE attributes are commonly used to filter notable events in the Incident Review dashboard?

Accepted Answer

Owner.. In the Incident Review dashboard, notable events are triaged using the fields that describe the state and assignment of each notable, so Owner (B) is correct because filtering by owner lets analysts isolate the notables assigned to a specific person or team. Status (C) is correct because notables carry review states such as New, In Progress, Pending, Resolved, and Closed, and filtering by status is a primary way to find unreviewed or open items. Urgency (E) is correct because urgency (Critical, High, Medium, Low, Informational) is a core notable attribute used to prioritize and filter the highest-priority incidents. License type (A) is not a notable-event attribute but a Splunk deployment/licensing property, and index name (D) is an underlying data-source detail rather than a standard Incident Review filter attribute.

Answer

License type.

Answer

Index name.

Question 10

Which TWO actions should be taken if a correlation search is consuming too many system resources?

Accepted Answer

Reduce the search frequency (cron schedule).. Option A is correct because reducing the search frequency (cron schedule) directly lowers how often the correlation search executes, cutting CPU, memory, and I/O load on the search head and indexers. Option E is correct because optimizing the search query with data model accelerated fields lets Splunk use pre-computed, summarized data instead of scanning raw events, dramatically reducing resource consumption and search time. Re-installing Splunk Enterprise (B) does not address the underlying resource cost of the search and risks unnecessary downtime. Deleting all historical data (C) is destructive, unnecessary, and does not fix the search's inefficiency. Switching operating systems (D) is irrelevant to search resource usage and would not resolve the problem.

Answer

Re-install the Splunk Enterprise application.

Answer

Delete all historical data.

Answer

Switch to a different operating system.

Question 11

Which THREE things are required for Splunk Enterprise Security to provide meaningful security insights?

Accepted Answer

Contextual Asset and Identity information.. Option B is correct because Splunk Enterprise Security relies on asset and identity lookups (via the Asset and Identity framework, populated through CSV lookups or identity management) to enrich events with ownership, priority, and user context, which is essential for risk scoring, correlation searches, and notable event triage. Option C is correct because ES correlation searches and data models depend on the Common Information Model (CIM), so raw data must be normalized into CIM-compliant data models (e.g., Authentication, Network_Traffic, Endpoint) using field aliases, tags, and calculated fields for meaningful detections. Option D is correct because ES can only analyze data that is properly indexed and parsed—correct sourcetypes, timestamps, and field extractions are prerequisites before CIM mapping and correlation can occur. Option A is not required; ES works with a single Splunk deployment and does not need a separate instance per sourcetype, as multiple sourcetypes are indexed together. Option E is not required because Splunk Enterprise Security is a software application that runs on supported hardware or virtualized/cloud infrastructure, not a dedicated appliance.

Answer

A separate Splunk instance for every sourcetype.

Answer

A dedicated hardware appliance.

Question 12

Which TWO types of events are typically categorized as 'Notable Events'?

Accepted Answer

Manually created incidents in Incident Review.. Option B is correct because manually created incidents in Incident Review are user-generated notable events; when an analyst creates an incident in Splunk Enterprise Security's Incident Review, it is stored as a notable event in the notable index and tracked through the investigation workflow. Option D is correct because correlation searches are the primary mechanism that generates notable events in Splunk ES; when a correlation search's triggering condition is met, it writes a notable event to the notable index for review in Incident Review. Option A is incorrect because the license master produces licensing-related internal messages (e.g., license violations or pool usage warnings), not notable events. Option C is incorrect because ordinary log events received by the indexer are raw indexed data, not notable events, unless a correlation search or manual action promotes them. Option E is incorrect because a user's browser history is endpoint/web data that would only become notable if a correlation search flagged it, not by its nature.

Answer

Events produced by the license master.

Answer

Every log event received by the indexer.

Answer

Browser history of a user.

Question 13

Which THREE diagnostic tools or logs are useful for troubleshooting a malfunctioning correlation search?

Accepted Answer

The 'notable' index logs.. The 'notable' index logs (A) are useful because correlation searches generate notable events that are written to the notable index, so inspecting it reveals whether the search fired and what it produced. scheduler.log (C) is essential because it records the scheduling of correlation searches, including skipped, deferred, or failed runs and any errors thrown during execution. The Search Job Inspector (E) is useful because it exposes the exact SPL executed, search duration, and detailed execution costs/errors, helping pinpoint why a correlation search misbehaves. The Splunk License usage report (B) only shows indexing volume against license limits and does not diagnose search logic or scheduling failures, and the user's web browser cache (D) is a client-side artifact unrelated to server-side correlation search execution.

Answer

The Splunk License usage report.

Answer

The user's web browser cache.

Question 14

Which TWO factors are critical for effective Asset and Identity enrichment?

Accepted Answer

The consistency of the source data files.. Effective Asset and Identity enrichment in Splunk Enterprise Security depends on the quality and reliability of the lookup data being ingested, so option B is correct: the consistency of the source data files (e.g., stable CSV schemas, uniform field names, and regularly refreshed asset/identity lookups) ensures that the correlation searches and lookups resolve correctly. Option E is also correct because the enrichment framework relies on correct matching logic — for example, matching an event's src/dest IP against the asset lookup's ip field or matching a user against the identity lookup's user field — since incorrect or ambiguous match fields (such as overlapping CIDR ranges or case-sensitive usernames) will produce wrong or missing enrichments. Option A is not critical because the physical location of the indexer does not affect lookup matching or data consistency. Option C is irrelevant since dashboard color choices are purely cosmetic. Option D is not critical because the OS version of the search head does not determine the correctness of asset and identity correlation.

Answer

The physical location of the Splunk indexer.

Answer

The number of colors used in the dashboard.

Answer

The version of the OS running on the search head.

Question 15

You are onboarding a new Windows Event Log source using the Splunk Universal Forwarder. To ensure the data conforms to the Splunk Common Information Model (CIM) for the Authentication data model, where should you primarily configure the sourcetype?

Accepted Answer

The input configuration within the Splunk Add-on for Microsoft Windows.. The Splunk Add-on for Microsoft Windows (TA-windows) contains the field extractions, event type definitions, and CIM-compliant tag mappings that normalize Windows Event Log data (e.g., EventCode 4624, 4625) into the Authentication data model's required fields like src, user, dest, and action. Sourcetype configuration and CIM tagging for Windows events are handled at the input/props level within this add-on, so it is the primary place to ensure data conforms to the CIM.

Answer

The data model acceleration settings in the ES app settings.

Answer

The index-time index routing configuration in indexes.conf.

Answer

The Notable Event Suppression configuration in Splunk ES.