SPLK-5001 SIEM Defenses And Data Practices — Timed 15 Questions

Question 1

Where should you perform the initial configuration of the Splunk Common Information Model (CIM) to ensure data is correctly normalized for Enterprise Security?

Accepted Answer

Settings > CIM Setup.. The CIM Setup page in the Splunk Web interface is the primary location for managing CIM data models and accelerations.

Answer

The local/inputs.conf file.

Answer

Splunk ES > Configure > Data Enrichment.

Answer

Settings > Data Model acceleration.

Question 2

You need to ensure that only authorized users can view certain sensitive notable events. How do you implement this in Splunk ES?

Accepted Answer

Create a separate index and assign role-based access.. Creating a separate index for sensitive notable events and assigning role-based access control (RBAC) ensures only authorized roles can search that index and view the notables. Splunk's index-level permissions are the standard mechanism for restricting data visibility, and notable events stored in that index inherit those restrictions. This is the correct way to enforce access control on sensitive notables.

Answer

Encrypt the notable events in the KV Store.

Answer

Hide the notable event in the Incident Review dashboard.

Answer

Change the notable event severity to 'Informational'.

Question 3

Which dashboard in Splunk ES provides a high-level view of threats and vulnerabilities mapped to the MITRE ATT&CK framework?

Accepted Answer

Security Posture.. The Security Posture dashboard in Splunk ES provides a high-level, executive-friendly view of threats and vulnerabilities mapped to the MITRE ATT&CK framework. It aggregates detections by ATT&CK tactic and technique, showing coverage gaps and overall security posture across the environment. This makes it the correct choice for a framework-mapped threat/vulnerability overview.

Answer

Asset Discovery.

Answer

Threat Intelligence Manager.

Answer

Incident Review.

Question 4

You need to ensure that the 'Threat Intelligence' framework periodically updates. Where do you configure the update interval?

Accepted Answer

In the Threat Intelligence Manager dashboard.. The Threat Intelligence framework's update interval is configured in the Threat Intelligence Manager dashboard, which provides a UI for managing threat source feeds, their download schedules, and parsing settings. This is the supported, documented location for configuring periodic updates.

Answer

Using a crontab on the OS level.

Answer

By modifying the threat data model.

Answer

In the global settings.conf file.

Question 5

Which field is mandatory for an event to be correctly categorized by the Common Information Model (CIM) 'Network Traffic' data model?

Accepted Answer

tag. The 'tag' field is mandatory for an event to be correctly categorized by the CIM Network Traffic data model, because tags are used to associate events with specific data models. Without the appropriate tag (e.g., 'network', 'traffic'), the event will not be mapped to the Network Traffic data model.

Answer

user

Answer

src_ip

Answer

host

Question 6

Which TWO methods can be used to suppress notable events?

Accepted Answer

Directly modifying the 'notable_event_suppression' KV Store collection.. Option D is correct because Splunk Enterprise Security stores suppression rules in the notable_event_suppression KV Store collection, and administrators can directly edit that collection (for example via the KV Store REST endpoint or a lookup editor) to add, modify, or remove suppression entries that prevent matching notable events from being created. Option E is correct because ES ships with the 'Notable Event Suppression' dashboard (under the Incident Review/Configuration area), which provides a supported UI for creating and managing suppression rules that write to the same notable_event_suppression KV Store collection. Option A is incorrect because restarting the search head cluster only redistributes searches and does not alter suppression logic or the suppression collection. Option B is incorrect because renaming an index changes where data is stored and searched, not whether notable events are suppressed. Option C is incorrect because inputs.conf controls data input settings such as sourcetype, host, and index, and has no role in notable event suppression.

Answer

Restarting the search head cluster.

Answer

Renaming the index.

Answer

Adding a block to the inputs.conf.

Question 7

Which THREE actions are necessary to successfully onboard a new data source into Splunk Enterprise Security?

Accepted Answer

Enable data model acceleration.. Option B is correct because Splunk Enterprise Security relies on accelerated data models (such as the Common Information Model and its Authentication, Network_Traffic, etc. models) to populate its correlation searches, dashboards, and risk framework, so enabling data model acceleration is required for the new source's data to be usable by ES. Option D is correct because ES expects data to land in specific indexes (for example, the default 'main' index or a dedicated index defined in the ES index configuration) so that the data model constraints and correlation searches can locate and search the events properly. Option E is correct because ES correlation searches and CIM-based detections depend on event types being tagged with the appropriate CIM tags (e.g., 'authentication', 'network', 'web') so the data is normalized and mapped to the correct data models. Option A is incorrect because disabling other Splunk apps is never required and would break ES functionality, and Option C is incorrect because creating a custom indexer cluster is not a prerequisite for onboarding a data source into ES.

Answer

Disable all other Splunk apps.

Answer

Create a custom indexer cluster.

Question 8

A security analyst needs to reduce the noise generated by a specific correlation search that triggers too frequently for authorized internal vulnerability scanners. What is the most efficient way to handle this in Splunk ES?

Accepted Answer

Use the Notable Event Suppression feature within the Incident Review dashboard.. Notable Event Suppression in Splunk ES is purpose-built to reduce noise from correlation searches that fire on known-good activity, such as authorized internal vulnerability scanners. It allows the analyst to define suppression rules (by field, time window, or rule) directly in the Incident Review dashboard without altering the underlying correlation search logic or risk framework. This preserves detection fidelity for other entities while silencing the specific noisy source.

Answer

Disable the correlation search and create a new one with an exclusion filter.

Answer

Modify the search logic to use an 'eval' statement to filter out the scanner IP address.

Answer

Change the risk score of the notable event to zero in the correlation search configuration.

Question 9

In Splunk ES, where can you manage the 'Risk Threshold' for triggering a Notable Event based on aggregate risk scores?

Accepted Answer

Configure > Data Enrichment > Risk Analysis. In Splunk Enterprise Security, the Risk Analysis framework allows you to define risk thresholds that, when exceeded by an entity's aggregate risk score, automatically generate a notable event. These thresholds are configured under Configure > Data Enrichment > Risk Analysis, where you can create risk rules that specify the threshold value, the risk object type (e.g., system, user), and the severity of the resulting notable event. This is the central place to manage risk-based alerting, not the Incident Review dashboard or correlation searches.

Answer

Incident Review Dashboard

Answer

Configure > Content > Correlation Searches

Answer

The Security Posture dashboard

Question 10

Which THREE of the following are necessary prerequisites for ensuring a new data source is correctly utilized by the ES 'Access' data model?

Accepted Answer

The data must be tagged with the appropriate CIM tags.. Option A is correct because the Splunk Common Information Model (CIM) relies on event tagging — the data must be tagged with the appropriate CIM tags (e.g., tag=authentication, tag=network) so that the Access data model's constraints can match the events. Option C is correct because a data model must be enabled for it to be used in searches (e.g., via the datamodel command or Pivot), and it must be accelerated to populate the summary (tsidx) data that makes the 'Access' data model performant and usable for reporting. Option E is correct because the sourcetype must be mapped to an existing CIM data model through the data model's object constraints (typically via the CIM add-on's sourcetype-to-data-model mapping), which is what associates the incoming data with the Access data model's fields and tags. Option B is not required — data can reside in any index (or multiple indexes) as long as it is tagged and mapped to the CIM; the 'main' index is not a prerequisite. Option D is not required — Splunk indexes events in their native format and extracts fields at search time, so converting data to JSON is not a prerequisite for CIM/data model utilization.

Answer

The data must be sent to the 'main' index.

Answer

The data must be converted to JSON format.

Question 11

Which TWO of the following are true regarding the configuration of notable events in Splunk ES?

Accepted Answer

Notable events can be created manually through the Incident Review interface.. Option B is correct because Splunk ES allows analysts to manually create notable events directly from the Incident Review dashboard, for example by using the 'Create New Event' action, which is useful for recording incidents that were not detected by automated correlation searches. Option C is correct because in Splunk ES the urgency of a notable event is derived from the combination of its impact and severity values (via the urgency lookup/matrix), so urgency is indeed a calculation of impact and severity. Option A is incorrect because notable events are stored in the 'notable' index by default, but this is a default configuration rather than a strict requirement, and the question asks about configuration truths rather than storage defaults. Option D is incorrect because notable events are not immutable; their status, owner, urgency, and other fields can be updated through the Incident Review interface or via the notable event update mechanisms. Option E is incorrect because, while correlation searches are the primary generator of notable events, they can also be created manually (as in option B) or via other means such as the REST API, so 'only' makes this statement false.

Answer

All notable events must be stored in the 'notable' index.

Answer

Notable events are immutable and cannot be updated after creation.

Answer

Notable events can only be generated by correlation searches.

Question 12

A security analyst runs the search `| tstats summariesonly=t count from datamodel=Authentication.Authentication by Authentication.user Authentication.src` and receives zero results, but an equivalent raw search over the `authentication` index returns thousands of events. The Authentication data model is enabled and accelerated, and the acceleration job shows a 100% completion rate. Which action should the analyst take to resolve the missing accelerated results?

Accepted Answer

Confirm the accelerated data model's time range covers the search period by reviewing the acceleration summary's retention and backfill settings.. When tstats with summariesonly=true returns no results but raw searches find events, the acceleration summary is not covering the queried time period. Acceleration summaries are built only for the configured summary range and retention window. Checking the data model's acceleration settings confirms whether the search falls inside that window, which is the definitive fix for this symptom.

Answer

Change the search to summariesonly=false so tstats reads raw events in addition to the acceleration summary.

Answer

Re-run the data model acceleration job manually because a 100% completion rate does not guarantee the summary is queryable.

Answer

Verify that the Authentication data model's root search event constraints match the sourcetype and index of the raw authentication events.

Question 13

A Splunk ES analyst is investigating a notable event and wants to see the raw events that contributed to it. The notable event has a field called 'orig_event_id'. Which search should the analyst run to retrieve the original events?

Accepted Answer

index=notable | search orig_event_id=* | lookup original_event_lookup orig_event_id. The correct approach is to use the lookup provided by Splunk ES that maps orig_event_id to the original events. This method is efficient and reliable, leveraging the built-in functionality designed for this purpose.

Answer

index=notable | search orig_event_id=* | map search="index=* event_id=$orig_event_id$"

Answer

index=notable | search orig_event_id=* | lookup ...

Answer

index=* | search event_id=orig_event_id

Question 14

You are configuring data intake for Splunk Enterprise Security. To ensure that the data is properly normalized and can be used by ES correlation searches, which two actions must be performed when onboarding a new log source? (Choose two.)

Accepted Answer

Map the source to a CIM data model using the CIM Setup interface.. To onboard a new log source for ES, you must map it to a CIM data model using CIM Setup and ensure that data model acceleration is enabled and validated. These steps normalize the data and make it performant for correlation searches.

Answer

Create a new index for the data and set the retention policy.

Answer

Add the source to the Identity lookup table to resolve user identities.

Answer

Configure a new correlation search to test the data.

Question 15

You are configuring a new correlation search in Splunk Enterprise Security that must generate a notable event only when a user successfully authenticates from a foreign country and then accesses a sensitive file share within 10 minutes. The search must use data from two different indexes: 'authentication' and 'fileshare'. Which Splunk ES feature allows you to correlate these events across indexes and apply the time constraint?

Accepted Answer

Correlation search with a time window and the 'transaction' command. The scenario requires correlating authentication and file access events across two indexes within a 10-minute window. A correlation search in Splunk ES is the correct tool because it can incorporate a transaction search to group events by user and enforce the time constraint. This approach leverages the ES framework to generate notable events and apply risk scoring, which is essential for the defense analyst workflow.

Answer

Data model acceleration with a custom constraint

Answer

Correlation search with a join or append subsearch

Answer

Transaction search with a maxspan of 10 minutes