SPLK-5001 Threat And Attack Types Practice Test 2 — 15 Questions

Question 1

You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Risk Analysis. Risk Analysis in Splunk Enterprise Security is the framework that assigns risk scores to entities (users, systems, IPs) based on risk-modifying searches and correlation searches. Because risk scores accumulate over time and are tied to a specific entity via the risk object, it is the feature designed to correlate many events occurring across a long duration to a single entity. This makes it the correct tool for tracking slow, low-and-slow insider threat behavior such as gradual data exfiltration.

Answer

Notable Event Aggregation

Answer

Asset Investigator

Answer

Threat Activity

Question 2

A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?

Accepted Answer

Access Anomalies. The Access Anomalies dashboard in Splunk Enterprise Security is designed to surface unusual authentication behavior, including spikes in failed logins followed by successful logins from new or unusual IP addresses — the classic signature of a brute-force attack. It aggregates authentication data and highlights anomalies in access patterns, making it the correct dashboard for this investigation.

Answer

User Activity Center

Answer

Protocol Intelligence

Answer

Threat Intelligence Activity

Question 3

You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?

Accepted Answer

Threat Intelligence Framework. The Threat Intelligence Framework in Splunk ES ingests threat feeds (including TOR exit node lists) and matches them against events via the Threat Intelligence data model and correlation searches. It is the designated feature for identifying whether an IP, domain, or file hash is known malicious. Other ES features handle suppression, identity, or asset context, not threat matching.

Answer

Notable Event Suppressor

Answer

Identity Table

Answer

Asset Table

Question 4

An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?

Accepted Answer

file_hash. The file_hash field in a Splunk ES notable event contains the hash (MD5/SHA) of the file involved in the detection, which is the primary pivot key for the File domain investigation dashboard. That dashboard is designed to look up file reputation, sandbox results, and endpoint activity by hash, making file_hash the most effective field for pivoting there.

Answer

src_user

Answer

signature

Answer

dest_port

Question 5

You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?

Accepted Answer

Change Analysis. The Change Analysis CIM data model is designed to capture changes to system configuration, including audit policy modifications. When auditpol.exe is used to alter audit policies, the resulting Windows Security event (typically Event ID 4719, 'System audit policy was changed') maps to Change Analysis via fields like object, change_type, and user. Network Traffic, Endpoint, and Authentication models do not represent configuration-change events.

Answer

Network Traffic

Answer

Endpoint

Answer

Authentication

Question 6

A malware infection is suspected on a host. You notice traffic on port 445. Which Splunk ES correlation search should be prioritized to investigate lateral movement?

Accepted Answer

Lateral Movement. Port 445 is used by SMB (Server Message Block), which is the primary protocol for Windows file sharing and is commonly abused for lateral movement via tools like PsExec, SMBExec, and WannaCry-style propagation. Splunk ES includes a 'Lateral Movement' correlation search that detects suspicious SMB connections, remote service creation, and other lateral movement techniques. Prioritizing this search directly addresses the observed traffic and the suspected malware infection.

Answer

Brute Force Access

Answer

Malware Detection

Answer

DGA Detection

Question 7

An analyst identifies a command-and-control (C2) beaconing pattern. Which search command would be best used to identify the frequency of connections to a specific domain?

Accepted Answer

timechart. timechart is designed to plot aggregated values over time, making it ideal for visualizing the regularity of connections to a specific domain. By running timechart count by domain (or by dest), an analyst can see evenly spaced spikes that indicate beaconing intervals. This time-series view is exactly what C2 beacon detection requires.

Answer

stats

Answer

transaction

Answer

eval

Question 8

You are investigating a user who has triggered multiple high-risk alerts. Where in Splunk ES can you view the historical risk score progression for this specific user?

Accepted Answer

Risk Analysis. The Risk Analysis dashboard in Splunk Enterprise Security is purpose-built to display risk score progression over time for entities such as users, systems, and other risk objects. It aggregates risk events generated by correlation searches and shows how scores accumulate and decay. This is the correct place to trace a specific user's historical risk trajectory.

Answer

Notable Event Analysis

Answer

Asset Investigator

Answer

Incident Review

Question 9

Which Splunk ES dashboard allows an analyst to see a summary of all active notable events currently requiring investigation?

Accepted Answer

Incident Review. The Incident Review dashboard in Splunk Enterprise Security is the central analyst workspace that displays all notable events generated by correlation searches, including their urgency, status, owner, and disposition. It aggregates active notables requiring triage, allowing analysts to filter, assign, and investigate them. This is the primary dashboard referenced in ES for managing the notable event lifecycle.

Answer

Threat Intelligence

Answer

Security Posture

Answer

User Activity

Question 10

You need to ensure that your Splunk ES environment is properly ingesting threat intelligence data. Where can you confirm that threat sources are active?

Accepted Answer

Configure > Threat Intelligence > Threat Sources. In Splunk Enterprise Security, threat intelligence sources are configured and monitored under Configure > Threat Intelligence > Threat Sources. This page lists all configured intelligence sources, their status (enabled/disabled), last update time, and any errors, allowing you to confirm active ingestion. It is the authoritative location for verifying threat feed health.

Answer

Configure > Data Inputs

Answer

Dashboard > Threat Intelligence

Answer

Configure > Content Management

Question 11

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

Accepted Answer

Change Analysis. The Change Analysis data model in Splunk ES tracks changes to system configurations, including audit log clears and service changes. Clearing the Windows Security Event log generates Event ID 1102 (or 104 for older systems), which the Change Analysis data model captures as a change event, making it the correct detection source.

Answer

Endpoint

Answer

Network Traffic

Answer

Authentication

Question 12

You notice a system process attempting to connect to a suspicious external domain. Which CIM data model would contain this network connection information?

Accepted Answer

Network Traffic. The Network Traffic data model in the Splunk Common Information Model (CIM) is designed to normalize network connection events, including source/destination IPs, ports, protocols, and domain names. A system process attempting an outbound connection to a suspicious external domain would generate network telemetry (e.g., from firewalls, proxies, or Zeek) that maps to this model. Therefore, Network Traffic is the correct CIM data model to search for such activity.

Answer

Authentication

Answer

Change Analysis

Answer

Endpoint

Question 13

An attacker is using PowerShell to obfuscate their activities. Which data model is most appropriate for searching for encoded PowerShell commands?

Accepted Answer

Endpoint. The Endpoint data model is designed to capture process execution, command-line arguments, and script block logging on hosts, which are essential for detecting obfuscated PowerShell. It includes fields like process, process_name, and process_exec that store the full command line, allowing you to search for encoded commands (e.g., -EncodedCommand). Since PowerShell obfuscation occurs at the endpoint level, this data model provides the necessary context to identify and investigate such activity.

Answer

Network Sessions

Answer

Web

Answer

Authentication

Question 14

What is the primary function of the 'Incident Review' dashboard in Splunk ES?

Accepted Answer

Managing notable events. The Incident Review dashboard in Splunk Enterprise Security is the primary analyst workspace for triaging, investigating, and managing notable events. It aggregates notables generated by correlation searches and provides workflows for status changes, assignments, comments, and drill-downs. Its core function is notable event management, not data ingestion, performance monitoring, or threat feed creation.

Answer

Creating threat intelligence feeds

Answer

Monitoring system performance

Answer

Configuring data ingestion

Question 15

Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?

Accepted Answer

Correlation Search Editor. The Correlation Search Editor is the ES component used to create, edit, and manage correlation searches, including those that match events against a custom blacklist of domains. You define the search logic, schedule, throttling, and notable event settings here. It is the correct place to author a new rule that leverages a lookup or KV Store blacklist for domain matching.

Answer

Notable Event Suppressor

Answer

Risk Analysis Configuration

Answer

Threat Intelligence Framework