SPLK-5001 Threat And Attack Types — 10 Questions

Question 1

A phishing campaign is targeting your organization. Which Splunk ES module is best suited to track the delivery of the malicious email URLs?

Accepted Answer

Threat Intelligence. The Threat Intelligence module in Splunk Enterprise Security is designed to ingest, manage, and match threat indicators (IPs, domains, URLs, file hashes) against event data. For a phishing campaign delivering malicious URLs, the Threat Intelligence framework lets analysts track those URLs as indicators and correlate them with email and web traffic, making it the best module for tracking delivery of malicious email URLs.

Answer

Incident Review

Answer

Audit Trails

Answer

Content Management

Question 2

An attacker is attempting to use a 'Pass-the-Hash' technique. Which authentication log event code in Windows (Event ID 4624) should you look for to detect this?

Accepted Answer

4624. Event ID 4624 is the Windows Security log event for a successful logon, and it is the event that Pass-the-Hash detection focuses on because the attacker authenticates successfully using a stolen NTLM hash rather than a plaintext password. Within 4624, the Logon Type (commonly 3 for network or 9 for NewCredentials) and the Authentication Package (NTLM) fields reveal the anomalous pattern. Splunk ES correlates these 4624 events against known-good baselines to flag hash-based lateral movement.

Answer

4720

Answer

4625

Answer

4740

Question 3

A user reports receiving a suspicious email containing an attachment. Which Splunk ES feature allows you to quickly search for this file hash across your environment?

Accepted Answer

Enterprise Security Search bar. The 'Search' bar or 'Notable Event' context menus allow for rapid cross-environment investigation.

Answer

Dashboard > File Intelligence

Answer

Incident Review > Search by Hash

Answer

Search > File Hash Investigation

Question 4

You notice a high volume of traffic from an internal workstation to a non-standard port on an external server. Which search helps identify the frequency of this connection?

Accepted Answer

tstats. tstats is the correct choice because it queries accelerated data model summaries rather than raw events, delivering dramatically faster results for high-volume statistical searches like counting connections to a specific external port. For a hunt involving a high volume of traffic, tstats with a data model such as Network_Traffic or Web can return frequency counts in seconds where a raw search would take minutes. This performance advantage is exactly why tstats is the recommended tool for repetitive, high-cardinality hunting queries.

Answer

inputlookup

Answer

map

Answer

search

Question 5

You need to correlate a VPN login with a subsequent file access on an internal server. Which Splunk ES feature helps you link these disparate events?

Accepted Answer

Data Models. Data Models in Splunk ES provide structured, accelerated datasets that normalize fields across disparate sources, enabling correlation between events like a VPN login and a subsequent file access. By mapping both event types into common fields (user, src, dest, action), the data model allows a single search to link them. This is the ES feature designed for cross-source correlation.

Answer

Dashboard panels

Answer

Lookup tables

Answer

Saved searches

Question 6

An attacker has modified the registry to ensure persistence. Which Splunk ES data model tracks Windows registry changes?

Accepted Answer

Change Analysis. The Change Analysis data model in Splunk ES tracks changes to system configurations, including Windows registry modifications, file integrity changes, and endpoint configuration changes. It is specifically designed to detect persistence mechanisms and unauthorized system changes. The Endpoint data model covers process and file activity but not registry change tracking in the same way.

Answer

Web

Answer

Endpoint

Answer

Authentication

Question 7

Which THREE of the following data models are critical for monitoring lateral movement within a network?

Accepted Answer

Authentication. Authentication data (A) is critical because lateral movement typically involves credential use, pass-the-hash, Kerberos ticket abuse, or anomalous logon patterns (e.g., Event ID 4624 Type 3/10, 4648, 4768/4769), which reveal movement between hosts. Endpoint data (C) is essential since process creation, service installation, scheduled tasks, and remote execution artifacts (e.g., Sysmon Event IDs 1, 3, 11, 13) expose the techniques attackers use to pivot across systems. Network Traffic data (D) is required to detect internal reconnaissance, SMB/RDP/WinRM connections, and east-west flows that indicate a host is communicating with newly targeted internal systems. The Web (B) and Identity (E) models are not among the three critical models here: web data focuses on HTTP-based activity rather than internal pivoting, and identity, while related to authentication, is not the distinct model specified for this scenario.

Answer

Web

Answer

Identity

Question 8

Which THREE of the following fields are required for mapping data to the 'Authentication' CIM data model?

Accepted Answer

status. The Authentication data model requires the fields status, action, and user, so options A, B, and E are correct. status (A) is required because it records the outcome of the authentication attempt, such as success or failure, which is central to the model. action (B) is required because it specifies the authentication action taken, such as success, failure, or error, and is a mandatory field for the model. user (E) is required because it identifies the account being authenticated, which is the key subject of any authentication event. The unmarked options do not belong: dest_port (C) is a network traffic field more relevant to the Network Traffic model, and file_name (D) is a file-related field used in models such as Filesystem or Malware, not Authentication.

Answer

dest_port

Answer

file_name

Question 9

Which THREE of the following components are part of the 'Endpoint' data model?

Accepted Answer

Processes. The 'Endpoint' data model in Splunk UBA (and similar endpoint telemetry schemas) is built from host-level artifacts collected by endpoint agents, and Processes (A), Registry (D), and Filesystem (E) are all core components of that model. Processes (A) are included because process execution events (process name, PID, parent PID, command line, user) are fundamental endpoint telemetry used to detect malicious behavior such as suspicious child processes. Registry (D) is included because Windows registry key/value creation, modification, and deletion events are essential endpoint artifacts for detecting persistence mechanisms like Run keys or services. Filesystem (E) is included because file creation, modification, deletion, and hash events are core endpoint data used to track dropped payloads and file-based indicators. Network connections (B) belong to the network traffic/flow data model rather than the endpoint model, and HTTP Requests (C) belong to the web/proxy data model, so neither is part of the Endpoint data model.

Answer

Network connections

Answer

HTTP Requests

Question 10

While monitoring your Splunk ES environment, you notice a spike in authentication failures for multiple user accounts originating from a single external IP address. The failures occur within a short time window and target different usernames. Which type of attack is most likely occurring?

Accepted Answer

Credential stuffing. The scenario describes many failed logins for different usernames from a single external IP in a short time. This matches credential stuffing, where attackers use breached credential pairs to attempt access across many accounts. Password spraying uses a few common passwords against many accounts but typically with fewer attempts per account; brute force targets one account. Kerberoasting is unrelated to login failures.

Answer

Password spraying

Answer

Kerberoasting

Answer

Brute force