SPLK-5001 Threat And Attack Types Practice Test 3 — 15 Questions

Question 1

You are investigating a potential web-based attack. Which data model contains information regarding HTTP user-agents and request methods?

Accepted Answer

Web. The Web data model in Splunk's Common Information Model (CIM) contains information about web activity, including HTTP user-agents and request methods. It is designed to capture web server and web proxy logs, making it the correct choice for investigating web-based attacks.

Answer

Network Traffic

Answer

Authentication

Answer

Endpoint

Question 2

An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?

Accepted Answer

Endpoint. The Endpoint data model in Splunk is designed to normalize process execution, file system activity, and registry events from endpoint telemetry sources such as Sysmon, Windows Event Logs, and CrowdStrike. It includes process_name, process_path, parent_process_name, and user fields that allow correlation of a running process against its expected filesystem path. Comparing a renamed system process (e.g., svchost.exe running from C:\Temp) against known good paths is exactly the process-path correlation the Endpoint model supports.

Answer

Authentication

Answer

Network Traffic

Answer

Change Analysis

Question 3

You want to visualize the geographic origin of incoming connection attempts to identify potentially malicious traffic. Which dashboard is most appropriate?

Accepted Answer

Geographic Information. The Geographic Information dashboard in Splunk Enterprise Security is specifically designed to visualize the geographic origin of network traffic, including incoming connection attempts. It uses IP geolocation data to plot source and destination locations on a map, making it ideal for identifying potentially malicious traffic from unexpected regions. This dashboard directly addresses the requirement to visualize geographic origin, unlike the other dashboards which focus on different aspects of security intelligence.

Answer

Protocol Intelligence

Answer

Threat Intelligence

Answer

User Activity

Question 4

Where do you go in Splunk ES to adjust the sensitivity (risk score) of a specific correlation search?

Accepted Answer

Correlation Search Editor. The Correlation Search Editor is where you configure all aspects of a correlation search, including its risk score (risk analysis settings) and urgency. Adjusting the sensitivity of a specific correlation search means editing its risk score or risk object configuration, which is done in this editor. It provides the per-search control needed to tune detection sensitivity.

Answer

Notable Event Settings

Answer

Incident Review

Answer

Risk Analysis Dashboard

Question 5

Which TWO of the following are primary indicators of a phishing attack that you should look for in email logs?

Accepted Answer

Suspicious URL in email body. Option A (Suspicious URL in email body) is correct because phishing emails typically contain links to spoofed or malicious domains designed to harvest credentials or deliver malware, and these URLs are visible in email gateway or mail server logs as embedded hyperlinks that can be inspected for mismatched display text, URL shorteners, or known-bad domains. Option E (Unexpected sender domain) is correct because phishing often originates from look-alike or typosquatted domains (e.g., micros0ft.com) or compromised legitimate accounts, and analyzing the envelope sender and From header domains in email logs reveals these anomalies through SPF, DKIM, and DMARC failures. Option B (Successful authentication) is not a phishing indicator; it is a normal event that could occur after a user is tricked, but by itself it does not indicate phishing. Option C (High CPU usage on server) relates to resource consumption or malware/DoS activity, not to email-based phishing indicators. Option D (Unusual printer activity) is unrelated to phishing and would more likely indicate insider activity or a print server issue.

Answer

Successful authentication

Answer

High CPU usage on server

Answer

Unusual printer activity

Question 6

An attacker is using a technique that involves 'living off the land' by utilizing legitimate system tools. Which data model is most effective to monitor these tools?

Accepted Answer

Endpoint. The Endpoint data model is designed to capture process execution, file system activity, and other host-based events, which are exactly the artifacts left by living-off-the-land techniques. Tools like PowerShell, WMI, and certutil run as processes on endpoints, so their invocation is recorded in endpoint telemetry. This data model normalizes fields such as process_name, parent_process, and command_line, enabling effective detection of suspicious use of legitimate binaries.

Answer

Network Traffic

Answer

Authentication

Answer

Change Analysis

Question 7

A user account is exhibiting signs of being compromised. Where can you find the user's recent login history in Splunk ES?

Accepted Answer

User Activity. The User Activity dashboard in Splunk Enterprise Security is the correct location because it aggregates identity-centric information including recent logins, authentication history, and associated risk for a specific user. When investigating a potentially compromised account, analysts pivot to User Activity to see the timeline of successful and failed logons, source IPs, and related notable events. This view is purpose-built for identity investigation and is distinct from the broader Incident Review queue.

Answer

Threat Intelligence

Answer

Asset Investigator

Answer

Incident Review

Question 8

Which dashboard provides a summary of all assets categorized by their criticality within the organization?

Accepted Answer

Asset Investigator. The Asset Investigator dashboard in Splunk ES provides a consolidated view of assets, including their criticality, identity, and associated risk. It is the primary place to see assets categorized by business criticality and to pivot into asset-specific investigation. This matches the requirement of summarizing all assets by criticality.

Answer

Threat Activity

Answer

User Activity

Answer

Access Anomalies

Question 9

Which TWO of the following are valid methods to mitigate an insider threat within Splunk ES?

Accepted Answer

Enabling RBA for high-risk users. Option C is correct because Splunk Enterprise Security's Risk-Based Alerting (RBA) aggregates risk scores from risk modifiers and anomaly detections into risk index entries, allowing analysts to prioritize and investigate high-risk users whose cumulative risk exceeds defined thresholds — directly surfacing insider behavior that might otherwise go unnoticed. Option D is correct because Correlation Searches in Splunk ES run on schedules against indexed data and can trigger notable events when patterns such as large outbound data transfers, unusual download volumes, or access to sensitive indexes indicate potential data exfiltration by an insider. The remaining options are not valid Splunk ES mitigations: disabling all network ports (A) would break the Splunk deployment itself and is not a security control, manually logging all user keystrokes (B) is an endpoint/DLP function outside Splunk ES and raises privacy/legal issues, and deleting user accounts immediately (E) is a reactive, destructive action that destroys audit evidence rather than a mitigation method within Splunk ES.

Answer

Disabling all network ports

Answer

Manually logging all user keystrokes

Answer

Deleting user accounts immediately

Question 10

Which THREE of the following are common indicators that a host has been infected with malware?

Accepted Answer

Unusual outbound network connection. Option A is correct because malware typically establishes command-and-control (C2) channels or exfiltrates data, producing unusual outbound connections to unfamiliar IP addresses or ports that deviate from the host's normal traffic baseline. Option B is correct because many malware families tamper with system-critical files—such as modifying boot records, system binaries, or registry keys—to achieve persistence, escalate privileges, or disable security controls. Option C is correct because unexpected process execution, such as unknown or suspicious processes spawning from unusual parent processes, is a hallmark of malware running on a host. Option D is not an indicator of infection, since a successful user logout is a normal, expected system event. Option E is also not an indicator, as a user password reset is a legitimate administrative or self-service action rather than evidence of compromise.

Answer

Successful user logout

Answer

User password reset

Question 11

Which TWO of the following are key components of the Splunk ES Threat Intelligence framework?

Accepted Answer

Threat Source management. Option A (Threat Source management) is correct because the Splunk ES Threat Intelligence framework relies on configuring threat sources (such as local CSV lookups, threat intelligence feeds, or TAXII/STIX integrations) to ingest and normalize indicators of compromise into the system. Option E (Threat Intelligence collections) is correct because collections are the core construct that groups related threat intelligence data (e.g., IPs, domains, file hashes) and maps them to intelligence sources for use in correlation searches and adaptive response. Forwarder management (B) belongs to Splunk deployment/server administration for data collection, not the threat intelligence framework. Dashboard customization (C) is a general UI/presentation feature and not a structural component of the TI framework. Incident classification (D) relates to incident review and notable event workflow in ES, but it is not one of the key components that define the Threat Intelligence framework itself.

Answer

Forwarder management

Answer

Dashboard customization

Answer

Incident classification

Question 12

Which TWO of the following are common types of social engineering?

Accepted Answer

Pretexting. Pretexting (C) is a common social engineering technique in which an attacker invents a fabricated scenario or identity to manipulate a victim into divulging information or performing an action, exploiting human trust rather than technical flaws. Phishing (D) is likewise a core social engineering method, using fraudulent emails, messages, or websites to trick users into revealing credentials or clicking malicious links. Both rely on psychological manipulation of people, which is the defining characteristic of social engineering. By contrast, buffer overflow (A) and SQL injection (B) are technical software exploitation attacks against memory handling and database input validation respectively, and port scanning (E) is a network reconnaissance technique for discovering open TCP/UDP services — none of these target human behavior, so they are not social engineering types.

Answer

Buffer Overflow

Answer

SQL Injection

Answer

Port Scanning

Question 13

Which TWO of the following are examples of reconnaissance techniques used by attackers?

Accepted Answer

Domain footprinting. Domain footprinting (A) is a reconnaissance technique because it gathers information about a target organization's domains, subdomains, IP ranges, and DNS records using tools like WHOIS, nslookup, and dig, all without directly attacking the target. Port scanning (C) is also reconnaissance, as tools such as Nmap probe TCP/UDP ports to discover open services, running daemons, and potential entry points before exploitation. Both fall into the information-gathering phase of the attack lifecycle (e.g., MITRE ATT&CK Reconnaissance tactic). Password cracking (B) is an exploitation/credential-access activity, not reconnaissance, since it attempts to recover credentials from captured hashes. Log file deletion (D) is a defense-evasion and anti-forensics action performed after compromise. Data encryption (E) is a defensive or data-protection measure, not an attacker reconnaissance technique.

Answer

Password cracking

Answer

Log file deletion

Answer

Data encryption

Question 14

Which THREE of the following are benefits of using Risk-Based Alerting (RBA) in Splunk ES?

Accepted Answer

Improved focus on behavioral indicators. Option A is correct because RBA shifts detection from individual notable events to behavioral indicators, aggregating related events into risk attributions on entities (users, systems) so analysts can spot patterns of behavior rather than isolated signatures. Option B is correct because RBA assigns risk scores to entities via risk rules and risk factors, allowing threats to be prioritized by accumulated entity risk rather than by raw event severity. Option E is correct because RBA consolidates many low-fidelity or individually insignificant events into a smaller set of high-risk entities, thereby reducing alert noise and analyst fatigue. Option C is not correct because RBA is a detection and prioritization framework; Splunk ES does not automatically remediate threats, which requires separate orchestration tools such as Splunk SOAR. Option D is not correct because license management is handled by the Splunk license manager and is unrelated to RBA's risk scoring and alerting capabilities.

Answer

Automatic remediation of threats

Answer

Automatic license management

Question 15

Which THREE of the following data sources are most valuable for detecting an insider threat?

Accepted Answer

Endpoint file activity. Endpoint file activity (B) is valuable because insider threats often manifest as abnormal file access, copying, or exfiltration attempts on hosts, which can be captured via endpoint detection and response (EDR) telemetry and file auditing. VPN authentication logs (C) are valuable because they reveal remote access patterns, including logins from unusual locations or times, failed attempts, and concurrent sessions that may indicate credential misuse by an insider. Email outbound traffic (E) is valuable because insiders frequently exfiltrate sensitive data through email attachments or messages, and monitoring SMTP/Exchange traffic, attachment sizes, and recipient domains can surface such behavior. Printer toner levels (A) are merely consumable-maintenance metrics with no security relevance to user behavior. Router uptime logs (D) only indicate device availability and reboots, providing no insight into insider activity or data movement.

Answer

Printer toner levels

Answer

Router uptime logs