SPLK-5001 SPL Search Proficiency Practice Test 3 — 15 Questions

Question 1

A threat hunter is analyzing DNS logs and wants to identify domains that exhibit characteristics of domain generation algorithms (DGA). Which two SPL techniques are most effective for surfacing potential DGA domains? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Calculate the length of the domain name and use stats to find domains with unusually long or high-entropy subdomains.. DGA domains often have long, high-entropy names and are queried infrequently. Calculating domain length and entropy helps detect anomalous names, while the rare command surfaces low-frequency domains that are typical of DGA activity. The other techniques either focus on frequency or rare TLDs, which are less specific to DGA behavior.

Answer

Use the top command to find the most frequently queried domains and investigate those for malicious activity.

Answer

Use the transaction command to group DNS queries by src_ip and look for bursts of queries to many different domains.

Answer

Use eval with a regular expression to extract the top-level domain and then stats count by TLD to find rare TLDs.

Question 2

A SOC analyst is investigating a potential data exfiltration incident. They need to identify events where the 'bytes_out' field is greater than 1,000,000 and the 'dest_country' is not 'US'. Which SPL search correctly filters these events?

Accepted Answer

index=firewall bytes_out > 1000000 NOT dest_country=US. The correct search uses 'bytes_out > 1000000' for numeric filtering and 'NOT dest_country=US' to exclude US destinations. This ensures that events with large outbound bytes and non-US destinations are captured. The '!=' operator would also exclude events with missing country fields, which might be undesirable. The '<>' operator is invalid in Splunk. Using NOT with equality is the most precise way to filter out specific values while retaining events with null fields.

Answer

index=firewall bytes_out > 1000000 NOT dest_country="US"

Answer

index=firewall bytes_out > 1000000 dest_country<>US

Answer

index=firewall bytes_out > 1000000 dest_country!=US

Question 3

A security analyst is reviewing firewall logs and needs to calculate the ratio of inbound to outbound traffic for each destination IP. The logs contain separate events for inbound and outbound traffic, with a field 'direction' indicating 'in' or 'out' and a field 'bytes' indicating the size. Which SPL search will produce a table showing each destination IP with its inbound bytes, outbound bytes, and the ratio of inbound to outbound?

Accepted Answer

index=firewall | stats sum(eval(if(direction="in", bytes, 0))) as inbound sum(eval(if(direction="out", bytes, 0))) as outbound by dest_ip | eval ratio=inbound/outbound | table dest_ip inbound outbound ratio. The correct search uses stats with conditional eval to sum bytes for inbound and outbound traffic separately for each destination IP. This approach efficiently aggregates the data in one pass. The eval then calculates the ratio, and the table command displays the results. It avoids the pitfalls of multivalue fields or missing field references.

Answer

index=firewall | transaction dest_ip | stats sum(eval(if(direction="in", bytes, 0))) as inbound sum(eval(if(direction="out", bytes, 0))) as outbound | eval ratio=inbound/outbound | table dest_ip inbound outbound ratio

Answer

Answer

index=firewall | stats sum(bytes) as total by dest_ip direction | eval ratio=inbound/outbound | table dest_ip inbound outbound ratio

Question 4

A SOC analyst wants to create a search that returns events from the 'firewall' index where the action field is 'blocked' and the src_ip is not in a known whitelist of internal IPs. The whitelist is stored in a CSV lookup named 'internal_ips.csv' with a field 'ip'. Which SPL search correctly excludes events from whitelisted IPs?

Accepted Answer

index=firewall action=blocked NOT [ inputlookup internal_ips.csv | fields ip | rename ip AS src_ip ]. To exclude events based on a lookup, use a subsearch with inputlookup to fetch the values, rename the field to match, and apply NOT. This efficiently filters out whitelisted IPs. The other options either invert the logic, use invalid syntax, or fail to exclude correctly.

Answer

index=firewall action=blocked | join src_ip [ inputlookup internal_ips.csv | fields ip | rename ip AS src_ip ]

Answer

index=firewall action=blocked | lookup internal_ips.csv ip AS src_ip | where isnull(ip)

Answer

index=firewall action=blocked | search NOT src_ip IN (internal_ips.csv)

Question 5

An analyst needs to identify periods of unusually high login failures for a specific user account. They want to calculate the standard deviation of the number of failed logins per hour over the past week and flag hours where the count exceeds two standard deviations above the mean. Which SPL command sequence accomplishes this?

Accepted Answer

index=auth action=failure user=jsmith | bin _time span=1h | stats count by _time | eventstats avg(count) as avg stdev(count) as stdev | where count > avg + 2*stdev. To flag hours with counts exceeding two standard deviations above the mean, you must first aggregate counts per hour, then compute the mean and standard deviation across those hours using eventstats, and finally filter with where. This correctly applies the statistical threshold to each hour's count.

Answer

index=auth action=failure user=jsmith | bucket _time span=1h | stats count by _time | delta count as diff | where diff > 2*stdev(diff)

Answer

index=auth action=failure user=jsmith | timechart span=1h count | stats avg(count) as avg stdev(count) as stdev | where count > avg + 2*stdev

Answer

index=auth action=failure user=jsmith | bin _time span=1h | stats count by _time | where count > avg(count) + 2*stdev(count)

Question 6

A SOC analyst needs to identify which user accounts have the highest number of failed login attempts in the `auth` index over the past 24 hours. The failed login events contain the field `user`. The analyst runs a search that returns the top 10 users by failed login count. Which SPL command should be used to sort the results in descending order by the count and then limit the results to the top 10?

Accepted Answer

top limit=10 user. The `top` command is specifically designed to return the most frequent values of a field, with an optional limit. In this scenario, `top limit=10 user` efficiently retrieves the 10 users with the most failed login events, sorted in descending order. This leverages Splunk's distributed top-N algorithm, which is more efficient than using `stats` followed by `sort` and `head`, especially for large datasets.

Answer

rare user

Answer

stats count by user | sort - count | head 10

Answer

sort - count | head 10

Question 7

A security analyst is investigating a potential data exfiltration attempt. They have a search that returns events with fields `src_ip`, `dest_ip`, `bytes_out`, and `action`. They need to identify source IPs that have transferred more than 1 GB of data to external destinations, but only for events where the action is 'allowed'. They also want to include the total bytes transferred per source IP and sort the results in descending order. Which two SPL commands are required to achieve this? (Choose two.)

Accepted Answer

stats sum(bytes_out) as total_bytes by src_ip. To identify source IPs that transferred more than 1 GB, the analyst must first aggregate the total bytes per source IP using `stats sum(bytes_out) as total_bytes by src_ip`. Then, they must filter the aggregated results using `where total_bytes > 1073741824`. These two commands together produce the required list. Sorting is optional but not required by the question's core objective.

Answer

dedup src_ip

Answer

sort - total_bytes

Answer

search action=allowed

Question 8

A security analyst wants to create a search that returns events from the `firewall` index where the `action` field is either 'blocked' or 'denied'. The analyst also wants to ensure that the search only looks at events from the last 7 days. Which search string correctly achieves this?

Accepted Answer

index=firewall action=blocked OR action=denied earliest=-7d. The search `index=firewall action=blocked OR action=denied earliest=-7d` correctly filters events where the action is either 'blocked' or 'denied' and restricts the time range to the last 7 days. Using OR is the standard method to match multiple values for a field. The other options either use incorrect logic (AND), unnecessary parentheses, or invalid syntax (IN).

Answer

index=firewall (action=blocked OR action=denied) earliest=-7d

Answer

index=firewall action=blocked action=denied earliest=-7d

Answer

index=firewall action IN (blocked, denied) earliest=-7d

Question 9

Which command is used to visualize data in a time-series chart?

Accepted Answer

timechart count by sourcetype. The timechart command is purpose-built for time-series visualization in Splunk. It bins events by _time automatically and produces a table where each row is a time bucket and each column is a series (here, split by sourcetype), which the Splunk UI renders as a line/area chart. Because it aggregates over time by default, it is the canonical command for trend visualization.

Answer

graph count _time

Answer

stats count over time

Answer

chart count by _time

Question 10

Which command is used to rename a field in the results table for better readability?

Accepted Answer

rename src_ip as "Source Address". The rename command is specifically designed to rename fields in search results, and the syntax 'rename src_ip as "Source Address"' correctly renames the field src_ip to "Source Address" for display purposes. This is the standard SPL way to improve readability of field names in tables.

Answer

table src_ip as "Source Address"

Answer

fields src_ip:"Source Address"

Answer

eval "Source Address" = src_ip

Question 11

You are using a subsearch to find 'dest_ip' values that appeared in a 'failed_login' search. What is a common limitation of subsearches that you must consider?

Accepted Answer

Subsearches are limited by the 'maxout' configuration and execution time.. Subsearches in Splunk are constrained by the 'maxout' setting (default 50,000 results) which caps how many results the subsearch can return to the outer search, and by subsearch execution time limits (default 60 seconds via 'maxtime'). Exceeding either causes the subsearch to be truncated or aborted, silently dropping results and producing incomplete correlation.

Answer

Subsearches only return the first 10 results.

Answer

Subsearches cannot use the 'stats' command.

Answer

Subsearches cannot reference fields from the outer search.

Answer

Subsearches always run after the outer search completes.

Question 12

You have a field 'raw_data' containing JSON. How do you extract fields from it within your SPL search?

Accepted Answer

spath input=raw_data. The spath command is Splunk's dedicated SPL command for extracting fields from structured data formats like JSON and XML. Using 'spath input=raw_data' parses the JSON stored in the raw_data field and extracts its keys as Splunk fields, which can then be used in subsequent commands. This is the canonical way to extract JSON fields in SPL.

Answer

eval json_parse(raw_data)

Answer

json raw_data

Answer

extract json raw_data

Question 13

You want to dynamically update a lookup table with new indicators of compromise (IOCs) found during your search. Which command is used for this?

Accepted Answer

outputlookup ioc_list.csv. The outputlookup command is used to write search results to a lookup table file, such as a CSV. It takes the results of the current search and outputs them to the specified lookup file, dynamically updating it with new IOCs. This is the standard method for updating lookup tables from search results.

Answer

saveas lookup ioc_list.csv

Answer

write ioc_list.csv

Answer

inputlookup ioc_list.csv --append

Question 14

What is the purpose of the 'head' command?

Accepted Answer

Return the first N results.. The 'head' command in Splunk returns the first N results from a search, where N is specified as an argument (default 10). It is commonly used to limit the number of results for quick inspection or to reduce processing in a pipeline.

Answer

Return the last N results.

Answer

Sort the results.

Answer

Count the results.

Question 15

When using 'stats', how can you include the values of a field as columns in your output?

Accepted Answer

stats count by host, sourcetype | xyseries host, sourcetype, count. The xyseries command converts the results of a stats aggregation into a matrix (pivot) format, using one field for rows, another for column headers, and a numeric field for cell values. In this case, 'stats count by host, sourcetype' produces rows of (host, sourcetype, count), and 'xyseries host, sourcetype, count' pivots sourcetype values into distinct columns with counts as cell values. This is the canonical SPL way to turn grouped stats output into a wide table with field values as column headers.

Answer

stats count by host, sourcetype

Answer

stats count by host | transpose

Answer

stats pivot host sourcetype