SPLK-5001 Threat And Attack Types Practice Test 2 — 15 Questions

Question 1

An attacker is attempting to use a 'Pass-the-Hash' technique. Which authentication log event code in Windows (Event ID 4624) should you look for to detect this?

Accepted Answer

4624. Event ID 4624 with Logon Type 3 (Network) or 9 (NewCredentials) is often associated with pass-the-hash attacks.

Answer

4720

Answer

4625

Answer

4740

Question 2

What is the primary function of the 'Incident Review' dashboard in Splunk ES?

Accepted Answer

Managing notable events. Incident Review is the command center for investigating, assigning, and status-tracking notable events.

Answer

Creating threat intelligence feeds

Answer

Monitoring system performance

Answer

Configuring data ingestion

Question 3

Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?

Accepted Answer

Correlation Search Editor. The Correlation Search editor allows users to define custom search logic against threat intelligence lists.

Answer

Notable Event Suppressor

Answer

Risk Analysis Configuration

Answer

Threat Intelligence Framework

Question 4

You are investigating a potential web-based attack. Which data model contains information regarding HTTP user-agents and request methods?

Accepted Answer

Web. The 'Web' data model captures detailed information about web server traffic, including user-agents.

Answer

Network Traffic

Answer

Authentication

Answer

Endpoint

Question 5

An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?

Accepted Answer

Endpoint. The Endpoint data model contains the 'process_path' and 'process_name' fields required for this comparison.

Answer

Authentication

Answer

Network Traffic

Answer

Change Analysis

Question 6

You want to visualize the geographic origin of incoming connection attempts to identify potentially malicious traffic. Which dashboard is most appropriate?

Accepted Answer

Geographic Information. The 'Geographic Information' dashboard in Splunk ES maps IP addresses to geographic locations.

Answer

Protocol Intelligence

Answer

Threat Intelligence

Answer

User Activity

Question 7

You notice a high volume of traffic from an internal workstation to a non-standard port on an external server. Which search helps identify the frequency of this connection?

Accepted Answer

tstats. Using 'tstats' on the Network Traffic data model with 'count' grouped by time is the most efficient way to detect volume anomalies.

Answer

inputlookup

Answer

map

Answer

search

Question 8

You need to correlate a VPN login with a subsequent file access on an internal server. Which Splunk ES feature helps you link these disparate events?

Accepted Answer

Data Models. The 'Common Information Model' (CIM) enables correlation by normalizing fields like 'user' across different data sources.

Answer

Dashboard panels

Answer

Lookup tables

Answer

Saved searches

Question 9

An attacker has modified the registry to ensure persistence. Which Splunk ES data model tracks Windows registry changes?

Accepted Answer

Change Analysis. The 'Change Analysis' data model specifically tracks system configuration changes, including registry modifications.

Answer

Web

Answer

Endpoint

Answer

Authentication

Question 10

Where do you go in Splunk ES to adjust the sensitivity (risk score) of a specific correlation search?

Accepted Answer

Correlation Search Editor. The 'Correlation Search' settings allow for modifying the risk score assigned to notable events.

Answer

Notable Event Settings

Answer

Incident Review

Answer

Risk Analysis Dashboard

Question 11

Which TWO of the following are primary indicators of a phishing attack that you should look for in email logs?

Accepted Answer

Suspicious URL in email body. Phishing often uses suspicious sender domains and malicious embedded links.

Answer

Successful authentication

Answer

High CPU usage on server

Answer

Unusual printer activity

Question 12

An attacker is using a technique that involves 'living off the land' by utilizing legitimate system tools. Which data model is most effective to monitor these tools?

Accepted Answer

Endpoint. The Endpoint data model captures process execution, which is the primary indicator of living-off-the-land techniques.

Answer

Network Traffic

Answer

Authentication

Answer

Change Analysis

Question 13

A user account is exhibiting signs of being compromised. Where can you find the user's recent login history in Splunk ES?

Accepted Answer

User Activity. The User Activity dashboard or the Authentication data model is designed to show user-specific login trends.

Answer

Threat Intelligence

Answer

Asset Investigator

Answer

Incident Review

Question 14

Which dashboard provides a summary of all assets categorized by their criticality within the organization?

Accepted Answer

Asset Investigator. The 'Asset Investigator' or 'Security Posture' dashboards provide views of assets based on their identified risk and criticality.

Answer

Threat Activity

Answer

User Activity

Answer

Access Anomalies

Question 15

Which THREE of the following data models are critical for monitoring lateral movement within a network?

Accepted Answer

Authentication. Lateral movement involves network connections, user account usage, and system-level changes.

Answer

Web

Answer

Identity