SPLK-5001 Threat And Attack Types — 10 Questions

Question 1

A user reports receiving a suspicious email containing an attachment. Which Splunk ES feature allows you to quickly search for this file hash across your environment?

Accepted Answer

Enterprise Security Search bar. The 'Search' bar or 'Notable Event' context menus allow for rapid cross-environment investigation.

Answer

Dashboard > File Intelligence

Answer

Incident Review > Search by Hash

Answer

Search > File Hash Investigation

Question 2

You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?

Accepted Answer

Risk Analysis. Risk-Based Alerting (RBA) or Risk Analysis allows for aggregating risk scores over time for entities.

Answer

Notable Event Aggregation

Answer

Asset Investigator

Answer

Threat Activity

Question 3

A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?

Accepted Answer

Access Anomalies. The Access Anomalies dashboard provides a centralized view of authentication-related anomalies.

Answer

User Activity Center

Answer

Protocol Intelligence

Answer

Threat Intelligence Activity

Question 4

A phishing campaign is targeting your organization. Which Splunk ES module is best suited to track the delivery of the malicious email URLs?

Accepted Answer

Threat Intelligence. Threat Intelligence provides the infrastructure to ingest and correlate malicious URLs from phishing campaigns.

Answer

Incident Review

Answer

Audit Trails

Answer

Content Management

Question 5

You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?

Accepted Answer

Threat Intelligence Framework. Threat Intelligence Framework allows for the ingestion of threat intelligence lists like TOR exit nodes.

Answer

Notable Event Suppressor

Answer

Identity Table

Answer

Asset Table

Question 6

An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?

Accepted Answer

file_hash. The file_hash field is the standard normalized field in Splunk ES for tracking file identities across data sources.

Answer

src_user

Answer

signature

Answer

dest_port

Question 7

You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?

Accepted Answer

Change Analysis. The Change Analysis data model tracks configuration and policy changes within the environment.

Answer

Network Traffic

Answer

Endpoint

Answer

Authentication

Question 8

A malware infection is suspected on a host. You notice traffic on port 445. Which Splunk ES correlation search should be prioritized to investigate lateral movement?

Accepted Answer

Lateral Movement. Lateral movement typically involves SMB (port 445) traffic, which is tracked by the 'Lateral Movement' correlation search.

Answer

Brute Force Access

Answer

Malware Detection

Answer

DGA Detection

Question 9

An analyst identifies a command-and-control (C2) beaconing pattern. Which search command would be best used to identify the frequency of connections to a specific domain?

Accepted Answer

timechart. The 'timechart' command is ideal for visualizing events over time to detect periodic patterns indicative of beaconing.

Answer

stats

Answer

transaction

Answer

eval

Question 10

You are investigating a user who has triggered multiple high-risk alerts. Where in Splunk ES can you view the historical risk score progression for this specific user?

Accepted Answer

Risk Analysis. The 'Risk Analysis' dashboard displays the risk score trend for entities over time.

Answer

Notable Event Analysis

Answer

Asset Investigator

Answer

Incident Review