SPLK-5001 Threat And Attack Types — Timed 20 Questions

Question 1

A user reports receiving a suspicious email containing an attachment. Which Splunk ES feature allows you to quickly search for this file hash across your environment?

Accepted Answer

Enterprise Security Search bar. The 'Search' bar or 'Notable Event' context menus allow for rapid cross-environment investigation.

Answer

Dashboard > File Intelligence

Answer

Incident Review > Search by Hash

Answer

Search > File Hash Investigation

Question 2

You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?

Accepted Answer

Risk Analysis. Risk-Based Alerting (RBA) or Risk Analysis allows for aggregating risk scores over time for entities.

Answer

Notable Event Aggregation

Answer

Asset Investigator

Answer

Threat Activity

Question 3

A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?

Accepted Answer

Access Anomalies. The Access Anomalies dashboard provides a centralized view of authentication-related anomalies.

Answer

User Activity Center

Answer

Protocol Intelligence

Answer

Threat Intelligence Activity

Question 4

A phishing campaign is targeting your organization. Which Splunk ES module is best suited to track the delivery of the malicious email URLs?

Accepted Answer

Threat Intelligence. Threat Intelligence provides the infrastructure to ingest and correlate malicious URLs from phishing campaigns.

Answer

Incident Review

Answer

Audit Trails

Answer

Content Management

Question 5

You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?

Accepted Answer

Threat Intelligence Framework. Threat Intelligence Framework allows for the ingestion of threat intelligence lists like TOR exit nodes.

Answer

Notable Event Suppressor

Answer

Identity Table

Answer

Asset Table

Question 6

An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?

Accepted Answer

file_hash. The file_hash field is the standard normalized field in Splunk ES for tracking file identities across data sources.

Answer

src_user

Answer

signature

Answer

dest_port

Question 7

You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?

Accepted Answer

Change Analysis. The Change Analysis data model tracks configuration and policy changes within the environment.

Answer

Network Traffic

Answer

Endpoint

Answer

Authentication

Question 8

A malware infection is suspected on a host. You notice traffic on port 445. Which Splunk ES correlation search should be prioritized to investigate lateral movement?

Accepted Answer

Lateral Movement. Lateral movement typically involves SMB (port 445) traffic, which is tracked by the 'Lateral Movement' correlation search.

Answer

Brute Force Access

Answer

Malware Detection

Answer

DGA Detection

Question 9

An analyst identifies a command-and-control (C2) beaconing pattern. Which search command would be best used to identify the frequency of connections to a specific domain?

Accepted Answer

timechart. The 'timechart' command is ideal for visualizing events over time to detect periodic patterns indicative of beaconing.

Answer

stats

Answer

transaction

Answer

eval

Question 10

You are investigating a user who has triggered multiple high-risk alerts. Where in Splunk ES can you view the historical risk score progression for this specific user?

Accepted Answer

Risk Analysis. The 'Risk Analysis' dashboard displays the risk score trend for entities over time.

Answer

Notable Event Analysis

Answer

Asset Investigator

Answer

Incident Review

Question 11

Which Splunk ES dashboard allows an analyst to see a summary of all active notable events currently requiring investigation?

Accepted Answer

Incident Review. The Incident Review dashboard is the primary interface for SOC analysts to manage active notable events.

Answer

Threat Intelligence

Answer

Security Posture

Answer

User Activity

Question 12

You need to ensure that your Splunk ES environment is properly ingesting threat intelligence data. Where can you confirm that threat sources are active?

Accepted Answer

Configure > Threat Intelligence > Threat Sources. The Threat Intelligence Uploads page or Data Sources page within the Threat Intelligence framework confirms connectivity.

Answer

Configure > Data Inputs

Answer

Dashboard > Threat Intelligence

Answer

Configure > Content Management

Question 13

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

Accepted Answer

Change Analysis. The 'Change Analysis' data model tracks significant system changes, including clearing security logs.

Answer

Endpoint

Answer

Network Traffic

Answer

Authentication

Question 14

You notice a system process attempting to connect to a suspicious external domain. Which CIM data model would contain this network connection information?

Accepted Answer

Network Traffic. The Network Traffic data model contains information about network connections, including source/destination IP, port, and protocol.

Answer

Authentication

Answer

Change Analysis

Answer

Endpoint

Question 15

An attacker is using PowerShell to obfuscate their activities. Which data model is most appropriate for searching for encoded PowerShell commands?

Accepted Answer

Endpoint. The Endpoint data model captures process command-line arguments where PowerShell activity resides.

Answer

Network Sessions

Answer

Web

Answer

Authentication

Question 16

An attacker is attempting to use a 'Pass-the-Hash' technique. Which authentication log event code in Windows (Event ID 4624) should you look for to detect this?

Accepted Answer

4624. Event ID 4624 with Logon Type 3 (Network) or 9 (NewCredentials) is often associated with pass-the-hash attacks.

Answer

4720

Answer

4625

Answer

4740

Question 17

What is the primary function of the 'Incident Review' dashboard in Splunk ES?

Accepted Answer

Managing notable events. Incident Review is the command center for investigating, assigning, and status-tracking notable events.

Answer

Creating threat intelligence feeds

Answer

Monitoring system performance

Answer

Configuring data ingestion

Question 18

Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?

Accepted Answer

Correlation Search Editor. The Correlation Search editor allows users to define custom search logic against threat intelligence lists.

Answer

Notable Event Suppressor

Answer

Risk Analysis Configuration

Answer

Threat Intelligence Framework

Question 19

You are investigating a potential web-based attack. Which data model contains information regarding HTTP user-agents and request methods?

Accepted Answer

Web. The 'Web' data model captures detailed information about web server traffic, including user-agents.

Answer

Network Traffic

Answer

Authentication

Answer

Endpoint

Question 20

An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?

Accepted Answer

Endpoint. The Endpoint data model contains the 'process_path' and 'process_name' fields required for this comparison.

Answer

Authentication

Answer

Network Traffic

Answer

Change Analysis