SPLK-5001 SIEM Defenses And Data Practices Practice Test 5 — 15 Questions

Question 1

You are troubleshooting why a specific Correlation Search is not appearing in the Incident Review dashboard despite the search returning results. What is the most likely cause?

Accepted Answer

The 'Notable' adaptive response action is not enabled in the search configuration.. For a correlation search's results to appear in Incident Review, the search must include the 'Notable' adaptive response action in its configuration. Without this action enabled, the search runs and returns results, but no notable events are written to the notable index, so Incident Review shows nothing. This is the most common cause of 'search fires but no notables appear.'

Answer

The correlation search schedule is set to 'Real-time'.

Answer

The user does not have the 'ess_admin' role.

Answer

The data model acceleration is lagging.

Question 2

Which component in the Splunk ES architecture is responsible for mapping disparate log sources to a unified schema?

Accepted Answer

Common Information Model (CIM) Add-on. The Common Information Model (CIM) Add-on in Splunk ES provides the field mappings and knowledge objects that normalize disparate log sources into a unified schema. It defines the data models (Authentication, Endpoint, Network Traffic, etc.) and the field aliases, tags, and event types required to populate them, enabling consistent searches and correlation across heterogeneous data.

Answer

Notable Event Suppression

Answer

Splunk Enterprise Security App

Answer

Splunk Indexer

Question 3

When configuring a risk-based correlation search, what is the primary purpose of the 'Risk Analysis' adaptive response action?

Accepted Answer

To attribute risk to a specific object, such as a user or system.. The Risk Analysis adaptive response action in a correlation search is used to attribute risk to a specific object (such as a user, system, or IP) by adding a risk score and risk message to that object. This feeds into the risk-based alerting framework, allowing ES to accumulate risk and generate notables when thresholds are exceeded.

Answer

To purge malicious events from the index.

Answer

To notify the SOC manager via email.

Answer

To automatically block the offending IP address on the firewall.

Question 4

A security engineer is configuring a new correlation search that needs to correlate data across two different indexes. Which Splunk ES feature allows for efficient correlation across large datasets?

Accepted Answer

Data Model Acceleration. Data Model Acceleration (DMA) pre-computes and stores summarized results for data models, allowing tstats searches to run against the accelerated summaries instead of raw events. This makes correlation searches that span large datasets across multiple indexes fast and efficient, because the correlation search can use tstats against accelerated data models rather than scanning raw events. This is the ES-recommended approach for high-volume correlation.

Answer

Summary Indexing

Answer

Correlation Search Tuning

Answer

Lookup file generation

Question 5

Which TWO of the following are valid methods for enriching notable events in Splunk ES?

Accepted Answer

Configuring the Asset and Identity framework.. Option D is correct because the Asset and Identity framework in Splunk ES enriches notable events by automatically appending asset and identity metadata (such as priority, category, owner, and business unit) to events based on IP, MAC, or user lookups, which directly enhances the context of notable events. Option E is correct because automatic lookup definitions (configured in props.conf and transforms.conf) perform lookup-based field enrichment at search time, appending metadata such as asset or identity attributes to events, which is a standard mechanism for enriching notable events in ES. Option A is incorrect because disabling real-time alerts only stops alert generation and does not add any contextual data to notable events. Option B is incorrect because extending a correlation search's time range affects when and how often the search runs, not the enrichment of the resulting notable events. Option C is incorrect because changing the indexer cluster replication factor is a data-availability and resilience setting and has no bearing on event enrichment.

Answer

Disabling real-time alerts.

Answer

Increasing the search time range of the correlation search.

Answer

Modifying the indexer cluster replication factor.

Question 6

You are a Splunk ES analyst investigating a notable event for an unusual login from a foreign IP. You need to determine the full context of the user's activity around that time, including all related authentication and VPN events. Which feature in Splunk Enterprise Security provides this consolidated view directly from the Incident Review dashboard?

Accepted Answer

Identity Investigator. Identity Investigator is the Splunk ES feature that aggregates and displays a user's activity across multiple data sources, enabling analysts to quickly understand the context of a notable event involving a specific user. It pulls together authentication, VPN, and other identity-related events, which is exactly what is required here.

Answer

Asset Investigator

Answer

Threat Intelligence Framework

Answer

Protocol Intelligence

Question 7

A security analyst notices that a correlation search configured to detect multiple failed logins across the organization is not triggering notable events, even though the raw events are searchable. The correlation search uses the Authentication data model. Upon investigation, the analyst finds that the Authentication data model is not accelerated. What is the most likely reason the correlation search is failing to generate notables?

Accepted Answer

The correlation search requires the Authentication data model to be accelerated to efficiently retrieve and correlate events, and without acceleration, it may time out or return no results.. The Authentication data model must be accelerated for correlation searches to efficiently query it. Without acceleration, the search may time out or return incomplete results, preventing notable event creation. Acceleration builds summaries that speed up searches, which is essential for timely detection in Splunk ES.

Answer

The correlation search is configured to run in real-time mode, which is disabled for accelerated data models.

Answer

The correlation search is missing the 'action.notable' alert action, so it cannot create notable events.

Answer

The correlation search's cron schedule is set to run only during off-peak hours, so it hasn't executed yet.

Question 8

A SOC manager is configuring a new correlation search in Splunk ES to detect potential data exfiltration. The search should trigger a notable event and also automatically create a ticket in the organization's ticketing system via a third-party API. Which two configurations are required to achieve this? (Choose two.)

Accepted Answer

Configure a custom alert action that sends a REST API call to the ticketing system.. To generate a notable event, the correlation search must have the notable event action enabled. To create a ticket via API, a custom alert action that makes the API call must be configured and added to the search's alert actions. These two actions together fulfill the requirements.

Answer

Create a saved search that runs the correlation search and sends an email.

Answer

Enable the risk analysis framework to assign a risk score to the user.

Answer

Set up a data model acceleration for the index containing the exfiltration data.

Question 9

You are reviewing the data ingestion pipeline for Splunk Enterprise Security. To ensure that the CIM (Common Information Model) is correctly applied to your data, which two actions are required when configuring a new data source? (Choose two.)

Accepted Answer

Apply the appropriate tags to the data source or fields.. To make a new data source CIM-compliant, you must map vendor-specific fields to CIM field names using field aliases and apply the correct tags to associate events with the appropriate data models. These two actions ensure that the data is normalized and included in the CIM, enabling correlation searches and other ES features to work correctly.

Answer

Create a new event type that tags the relevant fields.

Answer

Enable data model acceleration for all data models.

Answer

Create a new index for the data source.

Question 10

A security analyst is reviewing the Incident Review dashboard in Splunk ES and wants to add a new field to the table that displays notable events. The field, 'src_ip', is already present in the notable event's raw data but not displayed. What should the analyst do to make this field visible in the Incident Review table?

Accepted Answer

Configure the 'Incident Review - Table Attributes' settings in Splunk ES to include 'src_ip'.. The Incident Review table attributes are configurable through Splunk ES settings. Adding 'src_ip' to the list of attributes will make it appear as a column in the Incident Review dashboard, allowing analysts to see the source IP directly without altering the correlation search or creating custom dashboards.

Answer

Edit the correlation search to include 'src_ip' in the search results and re-run it.

Answer

Modify the Incident Review dashboard's table settings to add 'src_ip' as a column.

Answer

Create a new dashboard that queries notable events and includes 'src_ip'.

Question 11

A security analyst needs to quickly identify all notable events that are assigned to them and are still open. Which Splunk ES dashboard provides this information with the ability to filter by owner and status?

Accepted Answer

Incident Review. The Incident Review dashboard is the primary interface for analysts to view, filter, and manage notable events. It includes filters for owner, status, urgency, and other fields, enabling an analyst to quickly find notables assigned to them that are still open. This dashboard also supports actions like assigning, commenting, and closing notables, making it the correct choice.

Answer

Audit

Answer

Security Posture

Answer

Threat Activity

Question 12

A security engineer is configuring a correlation search that should only trigger a notable event if the source IP is not in a list of known internal IP addresses. The list is maintained in a CSV file on the Splunk search head. Which Splunk ES feature should the engineer use to reference this list within the correlation search?

Accepted Answer

Create a lookup definition and use the lookup command in the correlation search.. Using a lookup definition and the lookup command enables the correlation search to dynamically reference the CSV file. This allows the search to filter out known internal IPs and trigger notables only for external sources. It is the most efficient and maintainable approach in Splunk ES.

Answer

Use a subsearch to query the CSV file directly with the inputlookup command.

Answer

Embed the list of IPs directly in the correlation search using a where clause.

Answer

Upload the CSV file as a threat intelligence feed and use the threat intelligence framework.

Question 13

A security analyst is configuring a new data model in Splunk Enterprise Security to accelerate a correlation search. After creating the data model, the analyst notices that the correlation search is still not performing efficiently. What is the most likely reason for the poor performance?

Accepted Answer

The data model has not been accelerated.. Data model acceleration is essential for improving the performance of searches that use the data model. Without acceleration, the data model does not store precomputed results, so correlation searches must scan raw data, resulting in slower execution. Enabling acceleration allows the search to use the accelerated summaries, which are much faster to query.

Answer

The data model does not have any constraints defined.

Answer

The correlation search is using a slow search command.

Answer

The correlation search is not scheduled to run frequently enough.

Question 14

A security analyst is configuring a new correlation search in Splunk Enterprise Security to detect brute-force attacks. The analyst wants to ensure that the notable events generated by this search are properly categorized and can be easily tracked. Which two actions should the analyst perform when creating the correlation search? (Choose two.)

Accepted Answer

Assign a security domain to the correlation search.. Assigning a security domain and specifying an owner are two actions that directly enhance categorization and tracking of notable events. The security domain classifies the type of activity, while the owner provides accountability and facilitates filtering in Incident Review. These actions are part of the correlation search configuration and are considered best practices for managing notables effectively.

Answer

Configure a throttling window to prevent duplicate notable events.

Answer

Add the correlation search to a relevant use case library.

Answer

Set the correlation search's severity level to 'Critical'.

Question 15

You are building a correlation search that must trigger a notable event when a user's risk score exceeds 100 within a 24-hour period. The risk score is calculated from multiple risk events across different indexes. Which Splunk ES component should you use to aggregate the risk events and evaluate the threshold?

Accepted Answer

Risk Analysis framework with a correlation search using the 'risk' index. The Risk Analysis framework is designed to collect risk events into the 'risk' index, where they can be aggregated and analyzed. A correlation search can then query the 'risk' index, sum risk scores by user over a 24-hour window, and trigger a notable when the total exceeds 100. This approach leverages the built-in risk framework and is the correct way to implement risk-based alerting in Splunk ES.

Answer

Threat Intelligence framework with a lookup of known malicious users

Answer

Incident Review dashboard with a custom filter for risk score

Answer

Data Model acceleration on the Risk data model