SPLK-5001 Threat And Attack Types Practice Test 4 — 15 Questions

Question 1

Which TWO of the following are ways to verify if a file hash is truly malicious within Splunk ES?

Accepted Answer

Submit the hash to an external sandbox/reputation service. Option A is correct because submitting a file hash to an external sandbox or reputation service (e.g., VirusTotal, Hybrid Analysis) provides independent, multi-engine verdicts on whether that hash is known malicious, which is a standard validation step in Splunk ES investigations. Option B is correct because Splunk ES's Threat Intelligence framework lets you match the hash against configured threat intel sources and local intelligence stores, so a hit confirms the hash is associated with known malicious activity. Options C, D, and E are incorrect because restarting an endpoint, renaming a file, or changing its extension are remediation or evasion actions that do not verify whether the hash itself is malicious and provide no threat intelligence verdict.

Answer

Restart the endpoint

Answer

Rename the file

Answer

Change the file extension

Question 2

An analyst notices that several Windows workstations are repeatedly resolving domain names such as 'update.microsoft.com.security-check.net' and 'login.office365.com.auth-verify.org'. These lookups occur shortly before outbound HTTPS connections to the resolved IPs. Which type of attack technique is most consistent with this observation?

Accepted Answer

Domain impersonation via combosquatting. The hostnames combine a trusted brand with additional words in a way that forms a completely different registered domain, which is the defining characteristic of combosquatting. Because the lookups happen just before outbound connections, the workstations are likely contacting infrastructure controlled by an attacker. Recognizing this pattern helps analysts distinguish combosquatting from typosquatting, domain fronting, and DNS tunneling, each of which has different observable evidence in DNS and network logs.

Answer

DNS tunneling for command-and-control

Answer

Domain fronting through a content delivery network

Answer

Typosquatting of legitimate corporate domains

Question 3

An analyst is investigating a potential ransomware incident. They notice a high volume of file modifications with the .locky extension across multiple shared drives. Which Splunk ES data model is most appropriate to search for these file system changes?

Accepted Answer

Endpoint.Filesystem. The Endpoint.Filesystem data model is specifically designed to capture file system activity from endpoints, including file creation, modification, and deletion. In a ransomware scenario, the rapid appearance of files with a malicious extension like .locky across shared drives is a key indicator. Searching this data model allows the analyst to identify affected files, paths, and timestamps, facilitating containment and remediation.

Answer

Web

Answer

Network_Traffic

Answer

Authentication

Question 4

During an investigation of a suspected malware outbreak, an analyst needs to identify all internal hosts that have communicated with a known malicious IP address. Which Splunk ES data model should be used to search for this network communication?

Accepted Answer

Network_Traffic. The Network_Traffic data model is designed to capture network flow data, including source and destination IP addresses, ports, and protocols. In a malware outbreak, identifying all internal hosts that have communicated with a known malicious IP is critical for scoping the incident. By searching this data model, the analyst can quickly generate a list of affected hosts and the associated traffic details, enabling effective containment and remediation.

Answer

Authentication

Answer

Intrusion_Detection

Answer

Endpoint.Processes

Question 5

An analyst is reviewing Splunk Enterprise Security correlation search results and notices a notable event for a host named WEB-01 indicating a possible web shell. The analyst wants to quickly identify the exact command and URI used in the initial exploit. Which Splunk ES data model should the analyst examine to find the HTTP request method and URI associated with this event?

Accepted Answer

Web. The Web data model is specifically structured to normalize web server logs, making it the ideal source for HTTP request methods and URIs. When investigating a potential web shell, analysts need to examine the initial exploit's HTTP request to understand the attack vector. Other data models lack this application-layer detail, so the Web data model is the correct choice.

Answer

Network Traffic

Answer

Endpoint

Answer

Intrusion Detection

Question 6

An analyst is investigating a potential pass-the-hash attack. They want to search for successful authentications that used NTLM authentication where the source workstation differs from the destination workstation. Which Splunk ES data model and field combination is most appropriate?

Accepted Answer

Authentication data model, filtering on authentication_method=NTLM and src!=dest. The Authentication data model is the correct choice because it records authentication events with details like authentication_method, src, dest, and user. Pass-the-hash attacks typically manifest as successful NTLM authentications where the source workstation is different from the destination workstation, indicating lateral movement. By filtering on authentication_method=NTLM and src!=dest, the analyst can identify potential pass-the-hash activity, which is a critical step in detecting and responding to this attack.

Answer

Network_Traffic data model, filtering on dest_port=445 and src!=dest

Answer

Endpoint.Processes data model, filtering on process_name=lsass.exe and user=SYSTEM

Answer

Intrusion_Detection data model, filtering on signature=Pass-the-Hash

Question 7

An analyst notices a Splunk ES notable event indicating a possible DNS exfiltration. In the Network_Traffic data model, which field contains the domain name being queried by an internal host?

Accepted Answer

dns_query. The Network_Traffic data model includes the dns_query field specifically for DNS request events. When investigating DNS exfiltration, analysts must examine the queried domain names, which are stored in dns_query. This field allows detection of anomalous patterns such as long, random subdomains used to tunnel data. Other fields like dest_host or url do not capture the DNS query string and would lead to missed detection.

Answer

query

Answer

dest_host

Answer

url

Question 8

A Splunk ES analyst is investigating a series of notable events related to a possible DNS tunneling attack. The analyst wants to identify domains that are being queried with unusually high frequency or with long subdomain strings, which are common indicators of DNS tunneling. Which Splunk ES data model should the analyst use to efficiently search for these DNS query patterns?

Accepted Answer

Network Resolution. The Network Resolution data model is specifically built to normalize DNS and DHCP data, making it the primary source for DNS query analysis in Splunk ES. By searching this data model, analysts can detect anomalies such as high query volumes or unusually long subdomains, which are characteristic of DNS tunneling. Other data models lack the necessary DNS fields or focus on different protocols.

Answer

Network Traffic

Answer

Web

Answer

Intrusion Detection

Question 9

An analyst is investigating a suspected DNS tunneling attack. They need to identify hosts that are generating an unusually high number of DNS queries with long, random-looking subdomains. Which Splunk search is most effective for this detection?

Accepted Answer

index=dns | eval subdomain_len=len(query) | where subdomain_len > 50 | stats count by src_ip | where count > 50. DNS tunneling encodes data in subdomains, resulting in long, high-entropy query names and a high volume of queries from a single host. The search that evaluates query length and then counts per source IP addresses both characteristics. The other searches either lack length analysis, use averages that miss outliers, or rely on known domain patterns that attackers can easily change.

Answer

index=dns | stats avg(len(query)) as avg_len by src_ip | where avg_len > 20

Answer

index=dns | stats count by src_ip, query | where count > 100

Answer

index=dns | search query="*.evil.com" | stats count by src_ip

Question 10

A security analyst receives an alert about a possible DNS tunneling attack. They need to examine DNS query logs to identify unusually long domain names that might indicate data exfiltration. Which Splunk ES data model should they use?

Accepted Answer

Network_Resolution. The Network_Resolution data model is designed to capture DNS resolution events, including fields like query, answer, and query_type. DNS tunneling attacks often use long, encoded domain names to exfiltrate data. By searching this data model, the analyst can identify anomalies such as unusually long query names or high volumes of queries to a single domain, which are indicative of tunneling. This targeted approach enables efficient detection and response.

Answer

Endpoint.DNS

Answer

Network_Traffic

Answer

Web

Question 11

A Splunk ES analyst receives a notable event indicating that a user account has been locked out due to multiple failed login attempts. The analyst wants to determine if this is a brute force attack or a user error. Which data model should the analyst examine to review the authentication activity for that user?

Accepted Answer

Authentication. The Authentication data model is designed to normalize login activity from multiple sources, making it the ideal place to investigate failed login attempts and account lockouts. By examining this data model, analysts can see the frequency and source of failed logins, helping distinguish between a brute force attack and a user mistake. Other data models do not contain authentication events.

Answer

Change

Answer

Network Traffic

Answer

Endpoint

Question 12

An analyst in Splunk Enterprise Security is investigating a potential DNS tunneling attack. They need to identify hosts that are sending an unusually high number of DNS queries to a single external domain within a short time window. Which search provides the most direct evidence of this behavior?

Accepted Answer

index=dns sourcetype=stream:dns | stats count by src_ip, query | sort -count. DNS tunneling often involves a compromised host making numerous DNS queries to a single external domain to exfiltrate data. Aggregating counts by source IP and queried domain, then sorting by count, directly reveals this pattern. The other searches either omit the source IP, use irrelevant fields, or focus on unique domain counts, which are better suited for DGA detection rather than tunneling.

Answer

index=dns sourcetype=stream:dns | timechart span=1h count by query

Answer

index=dns sourcetype=stream:dns | stats dc(query) as unique_queries by src_ip | sort -unique_queries

Answer

index=dns sourcetype=stream:dns | stats sum(bytes) as total_bytes by dest_ip | sort -total_bytes

Question 13

A Splunk ES analyst notices a spike in `Endpoint` data model events where `process_name` is `powershell.exe` with a command line containing `-EncodedCommand` and `DownloadString`, spawning from `winword.exe` on several finance workstations. Which MITRE ATT&CK technique does this activity most directly map to?

Accepted Answer

T1059.001 – Command and Scripting Interpreter: PowerShell. The activity shows PowerShell being used to execute an encoded, remotely downloaded payload, which is the defining behavior of the PowerShell sub-technique under Command and Scripting Interpreter. Splunk ES correlates process launch and script-block logging from the Endpoint data model, letting analysts identify this technique even when the command is obfuscated with Base64 encoding.

Answer

T1055 – Process Injection

Answer

T1548.002 – Abuse Elevation Control Mechanism: Bypass User Account Control

Answer

T1204.002 – User Execution: Malicious File

Question 14

An attacker has gained access to a workstation and is attempting to move laterally within the network. Which TWO of the following techniques are commonly used for lateral movement that you should monitor in Splunk ES? (Choose two.)

Accepted Answer

Remote Desktop Protocol (RDP) hijacking. Lateral movement involves techniques that allow an attacker to move from one compromised system to another within a network. Pass-the-Hash and RDP hijacking are both established methods for achieving this. SQL injection, XSS, and phishing are attack types that target different stages: SQL injection and XSS are web application attacks, and phishing is an initial access vector. Thus, only Pass-the-Hash and RDP hijacking are correct.

Answer

Phishing

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 15

An analyst is investigating a suspected credential dumping attack on a Windows host. They want to identify evidence of this activity in Splunk ES. Which TWO of the following are valid indicators of credential dumping that can be found in Splunk ES data? (Choose two.)

Accepted Answer

Presence of a file named “lsass.dmp” in a temp directory. Credential dumping involves extracting credentials from memory or files. Access to lsass.exe with suspicious access rights indicates an attempt to read its memory, where credentials are stored. The creation of a file named lsass.dmp is a direct artifact of dumping the lsass process memory. Both indicators are observable in Splunk ES via endpoint data models and are strong evidence of credential dumping activity.

Answer

Anomalous number of failed logon attempts

Answer

Creation of a new service with a random name

Answer

Unexpected modification of the hosts file