SPLK-5001 SIEM Defenses And Data Practices — Timed 30 Questions

Question 1

Where should you perform the initial configuration of the Splunk Common Information Model (CIM) to ensure data is correctly normalized for Enterprise Security?

Accepted Answer

Settings > CIM Setup.. The CIM Setup page in the Splunk Web interface is the primary location for managing CIM data models and accelerations.

Answer

The local/inputs.conf file.

Answer

Splunk ES > Configure > Data Enrichment.

Answer

Settings > Data Model acceleration.

Question 2

You need to ensure that only authorized users can view certain sensitive notable events. How do you implement this in Splunk ES?

Accepted Answer

Create a separate index and assign role-based access.. Creating a separate index for sensitive notable events and assigning role-based access control (RBAC) ensures only authorized roles can search that index and view the notables. Splunk's index-level permissions are the standard mechanism for restricting data visibility, and notable events stored in that index inherit those restrictions. This is the correct way to enforce access control on sensitive notables.

Answer

Encrypt the notable events in the KV Store.

Answer

Hide the notable event in the Incident Review dashboard.

Answer

Change the notable event severity to 'Informational'.

Question 3

Which dashboard in Splunk ES provides a high-level view of threats and vulnerabilities mapped to the MITRE ATT&CK framework?

Accepted Answer

Security Posture.. The Security Posture dashboard in Splunk ES provides a high-level, executive-friendly view of threats and vulnerabilities mapped to the MITRE ATT&CK framework. It aggregates detections by ATT&CK tactic and technique, showing coverage gaps and overall security posture across the environment. This makes it the correct choice for a framework-mapped threat/vulnerability overview.

Answer

Asset Discovery.

Answer

Threat Intelligence Manager.

Answer

Incident Review.

Question 4

You need to ensure that the 'Threat Intelligence' framework periodically updates. Where do you configure the update interval?

Accepted Answer

In the Threat Intelligence Manager dashboard.. The Threat Intelligence framework's update interval is configured in the Threat Intelligence Manager dashboard, which provides a UI for managing threat source feeds, their download schedules, and parsing settings. This is the supported, documented location for configuring periodic updates.

Answer

Using a crontab on the OS level.

Answer

By modifying the threat data model.

Answer

In the global settings.conf file.

Question 5

Which field is mandatory for an event to be correctly categorized by the Common Information Model (CIM) 'Network Traffic' data model?

Accepted Answer

tag. The 'tag' field is mandatory for an event to be correctly categorized by the CIM Network Traffic data model, because tags are used to associate events with specific data models. Without the appropriate tag (e.g., 'network', 'traffic'), the event will not be mapped to the Network Traffic data model.

Answer

user

Answer

src_ip

Answer

host

Question 6

Which TWO methods can be used to suppress notable events?

Accepted Answer

Directly modifying the 'notable_event_suppression' KV Store collection.. Option D is correct because Splunk Enterprise Security stores suppression rules in the notable_event_suppression KV Store collection, and administrators can directly edit that collection (for example via the KV Store REST endpoint or a lookup editor) to add, modify, or remove suppression entries that prevent matching notable events from being created. Option E is correct because ES ships with the 'Notable Event Suppression' dashboard (under the Incident Review/Configuration area), which provides a supported UI for creating and managing suppression rules that write to the same notable_event_suppression KV Store collection. Option A is incorrect because restarting the search head cluster only redistributes searches and does not alter suppression logic or the suppression collection. Option B is incorrect because renaming an index changes where data is stored and searched, not whether notable events are suppressed. Option C is incorrect because inputs.conf controls data input settings such as sourcetype, host, and index, and has no role in notable event suppression.

Answer

Restarting the search head cluster.

Answer

Renaming the index.

Answer

Adding a block to the inputs.conf.

Question 7

Which THREE actions are necessary to successfully onboard a new data source into Splunk Enterprise Security?

Accepted Answer

Enable data model acceleration.. Option B is correct because Splunk Enterprise Security relies on accelerated data models (such as the Common Information Model and its Authentication, Network_Traffic, etc. models) to populate its correlation searches, dashboards, and risk framework, so enabling data model acceleration is required for the new source's data to be usable by ES. Option D is correct because ES expects data to land in specific indexes (for example, the default 'main' index or a dedicated index defined in the ES index configuration) so that the data model constraints and correlation searches can locate and search the events properly. Option E is correct because ES correlation searches and CIM-based detections depend on event types being tagged with the appropriate CIM tags (e.g., 'authentication', 'network', 'web') so the data is normalized and mapped to the correct data models. Option A is incorrect because disabling other Splunk apps is never required and would break ES functionality, and Option C is incorrect because creating a custom indexer cluster is not a prerequisite for onboarding a data source into ES.

Answer

Disable all other Splunk apps.

Answer

Create a custom indexer cluster.

Question 8

A security analyst needs to reduce the noise generated by a specific correlation search that triggers too frequently for authorized internal vulnerability scanners. What is the most efficient way to handle this in Splunk ES?

Accepted Answer

Use the Notable Event Suppression feature within the Incident Review dashboard.. Notable Event Suppression in Splunk ES is purpose-built to reduce noise from correlation searches that fire on known-good activity, such as authorized internal vulnerability scanners. It allows the analyst to define suppression rules (by field, time window, or rule) directly in the Incident Review dashboard without altering the underlying correlation search logic or risk framework. This preserves detection fidelity for other entities while silencing the specific noisy source.

Answer

Disable the correlation search and create a new one with an exclusion filter.

Answer

Modify the search logic to use an 'eval' statement to filter out the scanner IP address.

Answer

Change the risk score of the notable event to zero in the correlation search configuration.

Question 9

In Splunk ES, where can you manage the 'Risk Threshold' for triggering a Notable Event based on aggregate risk scores?

Accepted Answer

Configure > Data Enrichment > Risk Analysis. In Splunk Enterprise Security, the Risk Analysis framework allows you to define risk thresholds that, when exceeded by an entity's aggregate risk score, automatically generate a notable event. These thresholds are configured under Configure > Data Enrichment > Risk Analysis, where you can create risk rules that specify the threshold value, the risk object type (e.g., system, user), and the severity of the resulting notable event. This is the central place to manage risk-based alerting, not the Incident Review dashboard or correlation searches.

Answer

Incident Review Dashboard

Answer

Configure > Content > Correlation Searches

Answer

The Security Posture dashboard

Question 10

Which THREE of the following are necessary prerequisites for ensuring a new data source is correctly utilized by the ES 'Access' data model?

Accepted Answer

The data must be tagged with the appropriate CIM tags.. Option A is correct because the Splunk Common Information Model (CIM) relies on event tagging — the data must be tagged with the appropriate CIM tags (e.g., tag=authentication, tag=network) so that the Access data model's constraints can match the events. Option C is correct because a data model must be enabled for it to be used in searches (e.g., via the datamodel command or Pivot), and it must be accelerated to populate the summary (tsidx) data that makes the 'Access' data model performant and usable for reporting. Option E is correct because the sourcetype must be mapped to an existing CIM data model through the data model's object constraints (typically via the CIM add-on's sourcetype-to-data-model mapping), which is what associates the incoming data with the Access data model's fields and tags. Option B is not required — data can reside in any index (or multiple indexes) as long as it is tagged and mapped to the CIM; the 'main' index is not a prerequisite. Option D is not required — Splunk indexes events in their native format and extracts fields at search time, so converting data to JSON is not a prerequisite for CIM/data model utilization.

Answer

The data must be sent to the 'main' index.

Answer

The data must be converted to JSON format.

Question 11

Which TWO of the following are true regarding the configuration of notable events in Splunk ES?

Accepted Answer

Notable events can be created manually through the Incident Review interface.. Option B is correct because Splunk ES allows analysts to manually create notable events directly from the Incident Review dashboard, for example by using the 'Create New Event' action, which is useful for recording incidents that were not detected by automated correlation searches. Option C is correct because in Splunk ES the urgency of a notable event is derived from the combination of its impact and severity values (via the urgency lookup/matrix), so urgency is indeed a calculation of impact and severity. Option A is incorrect because notable events are stored in the 'notable' index by default, but this is a default configuration rather than a strict requirement, and the question asks about configuration truths rather than storage defaults. Option D is incorrect because notable events are not immutable; their status, owner, urgency, and other fields can be updated through the Incident Review interface or via the notable event update mechanisms. Option E is incorrect because, while correlation searches are the primary generator of notable events, they can also be created manually (as in option B) or via other means such as the REST API, so 'only' makes this statement false.

Answer

All notable events must be stored in the 'notable' index.

Answer

Notable events are immutable and cannot be updated after creation.

Answer

Notable events can only be generated by correlation searches.

Question 12

A security analyst runs the search `| tstats summariesonly=t count from datamodel=Authentication.Authentication by Authentication.user Authentication.src` and receives zero results, but an equivalent raw search over the `authentication` index returns thousands of events. The Authentication data model is enabled and accelerated, and the acceleration job shows a 100% completion rate. Which action should the analyst take to resolve the missing accelerated results?

Accepted Answer

Confirm the accelerated data model's time range covers the search period by reviewing the acceleration summary's retention and backfill settings.. When tstats with summariesonly=true returns no results but raw searches find events, the acceleration summary is not covering the queried time period. Acceleration summaries are built only for the configured summary range and retention window. Checking the data model's acceleration settings confirms whether the search falls inside that window, which is the definitive fix for this symptom.

Answer

Change the search to summariesonly=false so tstats reads raw events in addition to the acceleration summary.

Answer

Re-run the data model acceleration job manually because a 100% completion rate does not guarantee the summary is queryable.

Answer

Verify that the Authentication data model's root search event constraints match the sourcetype and index of the raw authentication events.

Question 13

A Splunk ES analyst is investigating a notable event and wants to see the raw events that contributed to it. The notable event has a field called 'orig_event_id'. Which search should the analyst run to retrieve the original events?

Accepted Answer

index=notable | search orig_event_id=* | lookup original_event_lookup orig_event_id. The correct approach is to use the lookup provided by Splunk ES that maps orig_event_id to the original events. This method is efficient and reliable, leveraging the built-in functionality designed for this purpose.

Answer

index=notable | search orig_event_id=* | map search="index=* event_id=$orig_event_id$"

Answer

index=notable | search orig_event_id=* | lookup ...

Answer

index=* | search event_id=orig_event_id

Question 14

You are configuring data intake for Splunk Enterprise Security. To ensure that the data is properly normalized and can be used by ES correlation searches, which two actions must be performed when onboarding a new log source? (Choose two.)

Accepted Answer

Map the source to a CIM data model using the CIM Setup interface.. To onboard a new log source for ES, you must map it to a CIM data model using CIM Setup and ensure that data model acceleration is enabled and validated. These steps normalize the data and make it performant for correlation searches.

Answer

Create a new index for the data and set the retention policy.

Answer

Add the source to the Identity lookup table to resolve user identities.

Answer

Configure a new correlation search to test the data.

Question 15

You are configuring a new correlation search in Splunk Enterprise Security that must generate a notable event only when a user successfully authenticates from a foreign country and then accesses a sensitive file share within 10 minutes. The search must use data from two different indexes: 'authentication' and 'fileshare'. Which Splunk ES feature allows you to correlate these events across indexes and apply the time constraint?

Accepted Answer

Correlation search with a time window and the 'transaction' command. The scenario requires correlating authentication and file access events across two indexes within a 10-minute window. A correlation search in Splunk ES is the correct tool because it can incorporate a transaction search to group events by user and enforce the time constraint. This approach leverages the ES framework to generate notable events and apply risk scoring, which is essential for the defense analyst workflow.

Answer

Data model acceleration with a custom constraint

Answer

Correlation search with a join or append subsearch

Answer

Transaction search with a maxspan of 10 minutes

Question 16

A SOC analyst is onboarding a new firewall log source into Splunk Enterprise Security. The firewall logs must be mapped to the Network_Traffic data model so that correlation searches and dashboards can use them. The analyst has already created the necessary field aliases in props.conf. Which additional configuration is required to make the data model acceleration include these logs?

Accepted Answer

Update the data model's root event search to include the new source type.. For data model acceleration to include new log sources, the data model's root event search must be updated to capture those events. Field aliases alone do not affect which events are accelerated; they only map field names. The root search defines the dataset, so adding the new source type there ensures the firewall logs are incorporated into the Network_Traffic data model and become available for correlation searches and dashboards.

Answer

Add the source type to the data model's acceleration whitelist in the Data Model Editor.

Answer

Modify the firewall logs' sourcetype to match an existing Network_Traffic source type.

Answer

Create a new tag for the firewall logs and add it to the Network_Traffic data model.

Question 17

A security analyst notices that a Risk Framework entry for a user is not increasing the risk score despite multiple notable events being generated for that user. The notable events are correctly mapped to the user, but the risk score remains unchanged. Which configuration should the analyst verify first to resolve this issue?

Accepted Answer

The risk rules in the Risk Framework are properly configured with the correct risk object and risk score.. Risk scores for users are updated through risk rules defined in the Risk Framework. If notable events are generated but risk scores remain unchanged, the most likely cause is that the risk rules are not correctly configured to map the user as a risk object with an associated risk score. Verifying the risk rules ensures that the user is properly associated and that the score is applied as intended.

Answer

The correlation search schedule is set to run every minute.

Answer

The Risk Analysis adaptive response action is enabled in the correlation search.

Answer

The notable event's urgency is set to High or Critical.

Question 18

A security team wants to create a correlation search that identifies when a user account is locked out and then successfully logs in within 10 minutes. They need to correlate events from the same user across two different indexes: 'wineventlog' for lockout events and 'linux_secure' for login events. Which Splunk ES feature should they use to join these events based on the user field and time window?

Accepted Answer

Splunk ES Correlation Search with the 'correlation' command using the user field and a time window.. The correlation command in Splunk ES is purpose-built for correlating events across indexes by grouping on a field and applying time windows. It efficiently handles the join logic and integrates with the notable event framework, making it the correct choice for detecting multi-step attack patterns like lockout then login.

Answer

Splunk ES Correlation Search with a join subsearch using the user field.

Answer

Splunk ES Asset and Identity framework to enrich user data.

Answer

Transaction search command with startswith and endswith options.

Question 19

A security analyst notices that a correlation search configured to detect multiple failed logins followed by a successful login is not generating notable events, even though the raw events are present in the 'auth' index. The search uses the 'stats' command to count failures by user and then filters for counts greater than 5. Upon reviewing the search, you find that the search is scheduled to run every 5 minutes with a time range of 'Last 5 minutes'. What is the most likely reason for the missing notables?

Accepted Answer

The search uses a time range of 'Last 5 minutes' and runs every 5 minutes, causing events to fall outside the search window due to index lag.. The correlation search runs every 5 minutes over the last 5 minutes, leaving no overlap. Indexing latency can cause events to be missed if they arrive after the search window. To fix this, increase the time range to overlap, such as 'Last 10 minutes' while running every 5 minutes, ensuring events are captured even with lag.

Answer

The correlation search is missing a throttle configuration, causing it to skip execution.

Answer

The 'stats' command is not supported in correlation searches.

Answer

The correlation search is not enabled in the ES configuration.

Question 20

An analyst is tuning Splunk Enterprise Security to reduce alert noise. A correlation search generates a notable event for every failed login from a single source IP, but the security team only wants to see these events when more than 10 failures occur within 5 minutes from the same IP. Which feature should the analyst configure to meet this requirement?

Accepted Answer

Notable event suppression with a throttle based on the src field. Notable event suppression with a throttle on the src field is the correct feature because it allows the correlation search to limit notable generation based on a field value. By configuring suppression, the analyst can ensure that after the first notable, subsequent events from the same source IP are suppressed for a specified period. This reduces noise. While it doesn't enforce a count threshold by itself, it is the mechanism to control when notables appear, and combined with a search that counts events, it achieves the goal. Other options do not directly address the need to conditionally generate notables based on event frequency.

Answer

Risk analysis framework with a risk score threshold

Answer

Adaptive response action to automatically block the source IP

Answer

Correlation search scheduling with a cron expression that runs every 5 minutes