SPLK-5001 Threat And Attack Types — 20 Questions

Question 1

A phishing campaign is targeting your organization. Which Splunk ES module is best suited to track the delivery of the malicious email URLs?

Accepted Answer

Threat Intelligence. The Threat Intelligence module in Splunk Enterprise Security is designed to ingest, manage, and match threat indicators (IPs, domains, URLs, file hashes) against event data. For a phishing campaign delivering malicious URLs, the Threat Intelligence framework lets analysts track those URLs as indicators and correlate them with email and web traffic, making it the best module for tracking delivery of malicious email URLs.

Answer

Incident Review

Answer

Audit Trails

Answer

Content Management

Question 2

An attacker is attempting to use a 'Pass-the-Hash' technique. Which authentication log event code in Windows (Event ID 4624) should you look for to detect this?

Accepted Answer

4624. Event ID 4624 is the Windows Security log event for a successful logon, and it is the event that Pass-the-Hash detection focuses on because the attacker authenticates successfully using a stolen NTLM hash rather than a plaintext password. Within 4624, the Logon Type (commonly 3 for network or 9 for NewCredentials) and the Authentication Package (NTLM) fields reveal the anomalous pattern. Splunk ES correlates these 4624 events against known-good baselines to flag hash-based lateral movement.

Answer

4720

Answer

4625

Answer

4740

Question 3

A user reports receiving a suspicious email containing an attachment. Which Splunk ES feature allows you to quickly search for this file hash across your environment?

Accepted Answer

Enterprise Security Search bar. The 'Search' bar or 'Notable Event' context menus allow for rapid cross-environment investigation.

Answer

Dashboard > File Intelligence

Answer

Incident Review > Search by Hash

Answer

Search > File Hash Investigation

Question 4

You notice a high volume of traffic from an internal workstation to a non-standard port on an external server. Which search helps identify the frequency of this connection?

Accepted Answer

tstats. tstats is the correct choice because it queries accelerated data model summaries rather than raw events, delivering dramatically faster results for high-volume statistical searches like counting connections to a specific external port. For a hunt involving a high volume of traffic, tstats with a data model such as Network_Traffic or Web can return frequency counts in seconds where a raw search would take minutes. This performance advantage is exactly why tstats is the recommended tool for repetitive, high-cardinality hunting queries.

Answer

inputlookup

Answer

map

Answer

search

Question 5

You need to correlate a VPN login with a subsequent file access on an internal server. Which Splunk ES feature helps you link these disparate events?

Accepted Answer

Data Models. Data Models in Splunk ES provide structured, accelerated datasets that normalize fields across disparate sources, enabling correlation between events like a VPN login and a subsequent file access. By mapping both event types into common fields (user, src, dest, action), the data model allows a single search to link them. This is the ES feature designed for cross-source correlation.

Answer

Dashboard panels

Answer

Lookup tables

Answer

Saved searches

Question 6

An attacker has modified the registry to ensure persistence. Which Splunk ES data model tracks Windows registry changes?

Accepted Answer

Change Analysis. The Change Analysis data model in Splunk ES tracks changes to system configurations, including Windows registry modifications, file integrity changes, and endpoint configuration changes. It is specifically designed to detect persistence mechanisms and unauthorized system changes. The Endpoint data model covers process and file activity but not registry change tracking in the same way.

Answer

Web

Answer

Endpoint

Answer

Authentication

Question 7

Which THREE of the following data models are critical for monitoring lateral movement within a network?

Accepted Answer

Authentication. Authentication data (A) is critical because lateral movement typically involves credential use, pass-the-hash, Kerberos ticket abuse, or anomalous logon patterns (e.g., Event ID 4624 Type 3/10, 4648, 4768/4769), which reveal movement between hosts. Endpoint data (C) is essential since process creation, service installation, scheduled tasks, and remote execution artifacts (e.g., Sysmon Event IDs 1, 3, 11, 13) expose the techniques attackers use to pivot across systems. Network Traffic data (D) is required to detect internal reconnaissance, SMB/RDP/WinRM connections, and east-west flows that indicate a host is communicating with newly targeted internal systems. The Web (B) and Identity (E) models are not among the three critical models here: web data focuses on HTTP-based activity rather than internal pivoting, and identity, while related to authentication, is not the distinct model specified for this scenario.

Answer

Web

Answer

Identity

Question 8

Which THREE of the following fields are required for mapping data to the 'Authentication' CIM data model?

Accepted Answer

status. The Authentication data model requires the fields status, action, and user, so options A, B, and E are correct. status (A) is required because it records the outcome of the authentication attempt, such as success or failure, which is central to the model. action (B) is required because it specifies the authentication action taken, such as success, failure, or error, and is a mandatory field for the model. user (E) is required because it identifies the account being authenticated, which is the key subject of any authentication event. The unmarked options do not belong: dest_port (C) is a network traffic field more relevant to the Network Traffic model, and file_name (D) is a file-related field used in models such as Filesystem or Malware, not Authentication.

Answer

dest_port

Answer

file_name

Question 9

Which THREE of the following components are part of the 'Endpoint' data model?

Accepted Answer

Processes. The 'Endpoint' data model in Splunk UBA (and similar endpoint telemetry schemas) is built from host-level artifacts collected by endpoint agents, and Processes (A), Registry (D), and Filesystem (E) are all core components of that model. Processes (A) are included because process execution events (process name, PID, parent PID, command line, user) are fundamental endpoint telemetry used to detect malicious behavior such as suspicious child processes. Registry (D) is included because Windows registry key/value creation, modification, and deletion events are essential endpoint artifacts for detecting persistence mechanisms like Run keys or services. Filesystem (E) is included because file creation, modification, deletion, and hash events are core endpoint data used to track dropped payloads and file-based indicators. Network connections (B) belong to the network traffic/flow data model rather than the endpoint model, and HTTP Requests (C) belong to the web/proxy data model, so neither is part of the Endpoint data model.

Answer

Network connections

Answer

HTTP Requests

Question 10

While monitoring your Splunk ES environment, you notice a spike in authentication failures for multiple user accounts originating from a single external IP address. The failures occur within a short time window and target different usernames. Which type of attack is most likely occurring?

Accepted Answer

Credential stuffing. The scenario describes many failed logins for different usernames from a single external IP in a short time. This matches credential stuffing, where attackers use breached credential pairs to attempt access across many accounts. Password spraying uses a few common passwords against many accounts but typically with fewer attempts per account; brute force targets one account. Kerberoasting is unrelated to login failures.

Answer

Password spraying

Answer

Kerberoasting

Answer

Brute force

Question 11

A security analyst is investigating a potential Kerberoasting attack. Which Splunk ES data model and field would best identify service ticket requests with weak encryption?

Accepted Answer

Endpoint data model, field ticket_encryption_type. Kerberoasting involves requesting Kerberos service tickets for accounts with Service Principal Names (SPNs) and then cracking the ticket offline. The encryption type of the requested ticket is a key indicator: RC4 (0x17) is weaker and often used by attackers. The Endpoint data model in Splunk ES includes Kerberos events and the ticket_encryption_type field, allowing analysts to search for service ticket requests with weak encryption. This enables detection of potential Kerberoasting activity.

Answer

Authentication data model, field ticket_encryption_type

Answer

Identity_Management data model, field ticket_encryption

Answer

Network_Traffic data model, field encryption_type

Question 12

A Splunk ES analyst is investigating a potential data exfiltration incident. The analyst suspects that an attacker is using DNS queries to transfer data out of the network. Which of the following Splunk ES correlation searches is specifically designed to detect this type of activity?

Accepted Answer

Detect DNS Tunneling. The 'Detect DNS Tunneling' correlation search is explicitly built to identify DNS tunneling, a common method for data exfiltration that uses DNS queries. It analyzes DNS patterns such as query frequency and subdomain length to flag suspicious activity. Other searches either target different protocols or are not specific to DNS tunneling, making them less effective for this scenario.

Answer

Detect Large Outbound Transfers

Answer

Detect Exfiltration via HTTP

Answer

Detect Anomalous DNS Activity

Question 13

During an investigation, an analyst observes a Linux server where the /tmp directory contains an executable that opens a raw socket and communicates with an external IP on port 4444. The process is running as root but the parent process is no longer present. Which Splunk ES data source and field combination best supports confirming this as a reverse shell?

Accepted Answer

Network_Traffic data model, using the All_Traffic node to filter for internal source, external destination, destination port 4444, and the process ID associated with the connection.. A reverse shell is confirmed by tying the suspicious process to an outbound connection. The Network_Traffic data model's All_Traffic node provides source, destination, port, and process context, letting the analyst match the /tmp executable's process ID to the external connection on port 4444 even though the parent process is gone.

Answer

Authentication data model, using the Successful_Authentication node to review root logons around the time the binary was created.

Answer

Web data model, using the Web_Traffic node to search for HTTP requests from the server to the external IP.

Answer

Endpoint data model, using the Processes node to correlate process_name, parent_process_name, and user, then pivot to network connections by process ID.

Question 14

A Splunk ES analyst needs to identify potential data exfiltration over HTTP by looking for large outbound POST requests. Which data model and field should be used to calculate the total bytes sent?

Accepted Answer

Network_Traffic data model, field bytes_out. To detect data exfiltration over HTTP via outbound POST requests, analysts should use the Network_Traffic data model's bytes_out field, which measures bytes sent from the source IP. The Web data model is HTTP-specific but its byte fields are from the server's perspective, making them less suitable for client-side exfiltration. Filtering for HTTP POST and large bytes_out values can reveal suspicious transfers.

Answer

Web data model, field bytes_in

Answer

Web data model, field bytes_out

Answer

Network_Traffic data model, field bytes_in

Question 15

An analyst is investigating a suspected supply chain compromise where a trusted software update mechanism may have delivered malicious code. Which TWO of the following Splunk ES activities best support determining whether the update was tampered with? (Choose two.)

Accepted Answer

Review the Endpoint data model for the update process spawning unexpected child processes or establishing outbound connections after installation.. Detecting a tampered update requires checking the package's integrity and observing how it behaves after installation. Comparing the downloaded hash to the vendor-published value reveals alteration, while reviewing endpoint process lineage and outbound connections exposes post-install behavior inconsistent with a legitimate update. Together they confirm whether the update mechanism delivered something malicious.

Answer

Verify the digital signature of the update package using endpoint or file integrity monitoring telemetry available in Splunk ES.

Answer

Check the Authentication data model for failed logons on the update server in the last 24 hours.

Answer

Search the Web data model for HTTP 404 responses from the vendor's download site.

Question 16

You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?

Accepted Answer

Risk Analysis. Risk Analysis in Splunk Enterprise Security is the framework that assigns risk scores to entities (users, systems, IPs) based on risk-modifying searches and correlation searches. Because risk scores accumulate over time and are tied to a specific entity via the risk object, it is the feature designed to correlate many events occurring across a long duration to a single entity. This makes it the correct tool for tracking slow, low-and-slow insider threat behavior such as gradual data exfiltration.

Answer

Notable Event Aggregation

Answer

Asset Investigator

Answer

Threat Activity

Question 17

A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?

Accepted Answer

Access Anomalies. The Access Anomalies dashboard in Splunk Enterprise Security is designed to surface unusual authentication behavior, including spikes in failed logins followed by successful logins from new or unusual IP addresses — the classic signature of a brute-force attack. It aggregates authentication data and highlights anomalies in access patterns, making it the correct dashboard for this investigation.

Answer

User Activity Center

Answer

Protocol Intelligence

Answer

Threat Intelligence Activity

Question 18

You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?

Accepted Answer

Threat Intelligence Framework. The Threat Intelligence Framework in Splunk ES ingests threat feeds (including TOR exit node lists) and matches them against events via the Threat Intelligence data model and correlation searches. It is the designated feature for identifying whether an IP, domain, or file hash is known malicious. Other ES features handle suppression, identity, or asset context, not threat matching.

Answer

Notable Event Suppressor

Answer

Identity Table

Answer

Asset Table

Question 19

An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?

Accepted Answer

file_hash. The file_hash field in a Splunk ES notable event contains the hash (MD5/SHA) of the file involved in the detection, which is the primary pivot key for the File domain investigation dashboard. That dashboard is designed to look up file reputation, sandbox results, and endpoint activity by hash, making file_hash the most effective field for pivoting there.

Answer

src_user

Answer

signature

Answer

dest_port

Question 20

You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?

Accepted Answer

Change Analysis. The Change Analysis CIM data model is designed to capture changes to system configuration, including audit policy modifications. When auditpol.exe is used to alter audit policies, the resulting Windows Security event (typically Event ID 4719, 'System audit policy was changed') maps to Change Analysis via fields like object, change_type, and user. Network Traffic, Endpoint, and Authentication models do not represent configuration-change events.

Answer

Network Traffic

Answer

Endpoint

Answer

Authentication