SPLK-5001 Threat And Attack Types Practice Test 5 — 15 Questions

Question 1

An analyst notices a Windows workstation repeatedly resolving long, random-looking subdomains under a single parent domain, followed by outbound DNS TXT queries. Which Splunk ES detection method is most appropriate to identify this as DNS tunneling?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Network_Traffic data model with a search that aggregates the length of DNS query names and the count of unique subdomains per parent domain, then apply a threshold-based correlation search.. DNS tunneling encodes data in query names and record types, producing long, random-looking subdomains and frequent TXT queries to one parent domain. The Network_Traffic data model holds DNS events and supports aggregation of query name length and unique subdomain counts per parent, making a threshold-based correlation search the reliable way to flag this behavior.

Answer

Use the Endpoint data model to look for process execution of signed system binaries that spawn child processes outside their normal parent.

Answer

Use the Authentication data model to count failed logons per hour and trigger an alert when the count exceeds a baseline.

Answer

Use the Web data model to search for HTTP POST requests containing base64-encoded parameters sent to a small set of external IPs.

Question 2

A Splunk ES analyst receives a notable event for 'Excessive Failed Logins' on a Windows server. The analyst wants to determine if this is a brute-force attack or a misconfigured service account. Which field in the notable event would best help differentiate between these two scenarios?

Accepted Answer

user. The user field is critical because it reveals which account is experiencing failures. A single service account with repeated failures suggests misconfiguration, while multiple user accounts or a privileged account targeted from an external IP indicates brute-force. The other fields provide context but do not directly differentiate between the two causes.

Answer

signature

Answer

dest

Answer

src

Question 3

During an investigation, an analyst observes multiple `Endpoint` events where `lsass.exe` is accessed with `PROCESS_VM_READ` by a non-standard binary named `diagtrack.exe` running from `C:\Users\Public\`. Which Splunk ES data model and field combination best supports detecting this credential-dumping behavior?

Accepted Answer

Endpoint data model, correlating `process_name` and `process_id` with `access` events from the `Processes` node. Detecting credential dumping requires visibility into process access events, which the Endpoint data model provides through its Processes node. By correlating the source binary with the target lsass.exe and the granted access mask, Splunk ES can identify suspicious memory reads that are characteristic of tools like Mimikatz or custom dumpers, even when the binary name is masqueraded.

Answer

Network_Traffic data model, filtering on `dest_port` and `bytes_out` to detect exfiltration

Answer

Authentication data model, using `user` and `src` fields to identify failed logon attempts

Answer

Change_Analysis data model, monitoring registry key modifications under `HKLM\SAM`

Question 4

A user reports that their files have been encrypted and a ransom note is displayed on their screen. Which type of malware is most likely responsible?

Accepted Answer

Ransomware. The scenario describes files being encrypted and a ransom note displayed, which are the defining characteristics of ransomware. Ransomware encrypts data and demands payment for decryption. Trojans, worms, and rootkits have different behaviors: Trojans deceive, worms self-replicate, and rootkits hide. None of these directly cause file encryption with a ransom demand.

Answer

Worm

Answer

Trojan

Answer

Rootkit

Question 5

An analyst is investigating a suspected DNS tunneling attack. Which Splunk ES data model and field should be used to identify hosts making an unusually high number of unique DNS queries with long subdomain strings?

Accepted Answer

Network_Resolution data model, using the `query` field and calculating the length of subdomain labels. DNS tunneling encodes data in subdomain labels, so detection requires examining the DNS query strings themselves. The Network_Resolution data model provides normalized DNS query and response fields, enabling Splunk ES searches that calculate query length, entropy, and uniqueness per host to flag potential tunneling.

Answer

Web data model, using the `uri_path` field to detect long encoded strings

Answer

Endpoint data model, analyzing `process_name` for `nslookup.exe` executions

Answer

Network_Traffic data model, filtering on `dest_port` 53 and measuring `bytes_in`

Question 6

An analyst is investigating a potential pass-the-hash attack in Splunk ES. Which TWO of the following are indicators that should be reviewed in Windows Security event logs? (Choose two.)

Accepted Answer

Event Code 4624 with Logon Type 3 and NTLM authentication. Pass-the-hash attacks leverage stolen NTLM hashes to authenticate, often resulting in Event Code 4624 with Logon Type 3 and NTLM authentication, and Event Code 4776 for credential validation. These events, when correlated, can reveal lateral movement. Other event codes like 4672, 4768, and 5140 are not specific to pass-the-hash and may generate false positives. Focusing on NTLM-related events is crucial for accurate detection.

Answer

Event Code 4768 with Kerberos TGT request

Answer

Event Code 5140 with network share access

Answer

Event Code 4672 with SeDebugPrivilege assigned

Question 7

An analyst is reviewing a notable event for a potential malware infection on a Windows endpoint. The event includes a file hash. To determine if the file is known malicious, the analyst wants to check its reputation using Splunk ES's threat intelligence framework. Which action should the analyst take?

Accepted Answer

Search the file hash in the Threat Intelligence data model to see if it matches any threat intel sources.. Splunk ES integrates threat intelligence feeds into the Threat Intelligence data model. By searching for the file hash there, the analyst can quickly see if it matches any known malicious indicators. The other options focus on endpoint activity or manual lists, which do not provide the same breadth of reputation data from multiple sources.

Answer

Run a search against the Endpoint data model to find all processes that executed the file hash.

Answer

Check the 'File Hash' field in the Malware data model to see if it is associated with any known malware families.

Answer

Use the 'threatlist' lookup to manually add the hash and then check if it appears in any notable events.

Question 8

An analyst observes a series of events where a process creates a child process with a command line that includes encoded PowerShell commands. The parent process is a Microsoft Office application. Which attack technique is most likely being used?

Accepted Answer

Phishing with a malicious macro. The scenario describes a Microsoft Office application spawning a child process with encoded PowerShell commands. This is a classic sign of a malicious macro, often delivered via phishing. Drive-by downloads, watering hole attacks, and supply chain compromises do not typically exhibit this specific process lineage. Therefore, the most likely technique is a phishing attack using a malicious macro.

Answer

Watering hole attack

Answer

Supply chain compromise

Answer

Drive-by download

Question 9

A Splunk ES analyst is investigating a potential ransomware incident. Which TWO of the following are valid indicators of ransomware activity that should be prioritized for detection? (Choose two.)

Accepted Answer

A sudden increase in SMB write operations to a single file server from multiple hosts. Ransomware's core behaviors are mass file encryption and lateral spread, often via SMB. Detecting high-volume file renames with ransomware extensions and spikes in SMB writes to shared servers directly targets these behaviors, providing actionable alerts. Other options are either unrelated or too nonspecific to prioritize.

Answer

A single failed login attempt from an external IP address

Answer

An increase in DNS queries for known cryptocurrency mining pools

Answer

A user reporting slower than usual workstation performance

Question 10

A Splunk ES analyst is investigating a potential Kerberoasting attack. The analyst wants to identify the key indicators of this activity. Which TWO of the following are primary indicators of a Kerberoasting attack that the analyst should look for in Splunk ES? (Choose two.)

Accepted Answer

A single user account requesting an unusually high number of service tickets for different SPNs in a short time.. Kerberoasting is characterized by attackers requesting service tickets for SPNs and then cracking them offline. The two primary indicators are a high volume of service ticket requests (Event ID 4769) with weak encryption like RC4, and a single user requesting many service tickets for different SPNs. These patterns are detectable in Splunk ES through the Authentication data model and custom correlation searches.

Answer

Multiple failed logon attempts (Event ID 4625) for a single user account within a short period.

Answer

The use of the KRBTGT account to request a ticket-granting ticket (TGT) with a long lifetime.

Answer

A sudden increase in DNS queries for service records (SRV) from a single host.

Question 11

A Splunk ES analyst is investigating a series of notable events indicating possible pass-the-hash attacks. The events show successful authentications using NTLM from unusual source workstations to multiple servers. Which data model should the analyst query to correlate the authentication events and identify the compromised user accounts?

Accepted Answer

Authentication. Pass-the-hash involves authenticating with stolen NTLM hashes, so the Authentication data model is the primary source for login events. It contains the necessary fields to correlate source, destination, and user accounts. The other data models either focus on different telemetry or lack the authentication details required for this specific attack analysis.

Answer

Network_Traffic

Answer

Endpoint

Answer

Identity_Management

Question 12

A SOC analyst receives an alert that a user's credentials were used from two geographically distant locations within five minutes. Which Splunk ES capability is designed to surface this type of anomaly by comparing current activity to a learned baseline?

Accepted Answer

User Behavior Analytics (UBA), which builds peer-group and individual baselines to detect anomalous access patterns such as impossible travel.. Impossible travel is a behavioral anomaly: the same user cannot physically move between distant locations in minutes. UBA learns each user's normal access patterns and peer-group norms, so a login pair that violates travel-time expectations stands out. That learned baseline is precisely what distinguishes UBA from enrichment-only or risk-aggregation features.

Answer

Risk-based alerting, which aggregates risk scores from multiple correlation searches into a single notable event for triage.

Answer

The Asset and Identity framework, which correlates events with asset ownership and identity metadata.

Answer

The Threat Intelligence framework, which enriches events with indicators of compromise from external feeds.

Question 13

An analyst is investigating a potential ransomware outbreak. They observe a high volume of file encryption activity and want to identify the initial infection vector. Which TWO of the following Splunk ES data models would be most useful to correlate endpoint and network activity to trace the source? (Choose two.)

Accepted Answer

Endpoint. Tracing a ransomware infection requires correlating endpoint process activity with network communications. The Endpoint data model reveals the execution chain and file modifications, while the Network_Traffic data model shows external connections that may indicate the delivery or C2. Together, they provide a comprehensive view to identify the initial vector.

Answer

Malware

Answer

Authentication

Answer

Web

Question 14

An attacker uses a weaponized document that exploits a vulnerability to execute code without writing a file to disk. Which detection approach in Splunk ES is best suited to identify this fileless attack?

Accepted Answer

Search the Endpoint data model for suspicious process behavior such as script interpreters spawning from productivity applications and making network connections.. Fileless attacks execute code in memory, often by abusing legitimate interpreters invoked by a document reader. The Endpoint data model records process creation, parent-child relationships, and command lines, so detecting a script interpreter spawning from a productivity application and making network connections is the most reliable way to surface this activity.

Answer

Review firewall logs for inbound connections to the document authoring workstation on unusual ports.

Answer

Monitor antivirus scan logs for signature matches on the downloaded document.

Answer

Check the Web data model for HTTP downloads of files with double extensions from known-bad domains.

Question 15

An analyst is investigating a potential DLL sideloading attack on a Windows host. Which Splunk ES data model and field can be used to detect the loading of a malicious DLL from an unusual path?

Accepted Answer

Endpoint data model, field dll_path. DLL sideloading involves a legitimate application loading a malicious DLL from an unexpected location. The Endpoint data model, populated by Sysmon Event ID 7 or similar, includes the dll_path field that records the loaded DLL's path. By analyzing dll_path for DLLs loaded from user-writable directories or unusual locations, analysts can detect sideloading attempts. Other data models lack the necessary file and process context.

Answer

Endpoint data model, field image_path

Answer

Identity_Management data model, field process_path

Answer

Network_Traffic data model, field file_path