SPLK-5001 Threat Hunting Practice Test 3 — 15 Questions

Question 1

In a threat hunting workflow, what is the primary purpose of a 'Lookback' period?

Accepted Answer

To align with attacker dwell time. The primary purpose of a 'Lookback' period in threat hunting is to align with attacker dwell time, which is the time an attacker remains undetected in a network. By setting a lookback period that covers the typical dwell time, hunters can search for indicators of compromise over a relevant historical window, increasing the chances of detecting ongoing or past intrusions.

Answer

To increase the search speed

Answer

To clear the cache

Answer

To reduce the number of false positives

Question 2

Which TWO actions should be performed during the 'Data Preparation' phase of a threat hunt to ensure accurate results?

Accepted Answer

Mapping data sources to the Splunk Common Information Model (CIM). Option A is correct because mapping data sources to the Splunk Common Information Model (CIM) normalizes fields and event types (e.g., src, dest, user, action) across heterogeneous sources, so searches and correlation rules return consistent, accurate results during the hunt. Option D is correct because verifying data availability for the required time range confirms that the relevant indexes, sourcetypes, and retention policies actually contain the events covering the hunt's window, preventing false negatives caused by missing or aged-out data. Together, these two actions ensure the data is both semantically aligned and temporally complete before analysis begins. Option B is not part of Data Preparation; applying machine learning models belongs to later analysis or detection phases. Option C is unrelated, as creating user accounts is an administrative access task, not a data preparation step. Option E is incorrect because drafting the final incident report occurs at the conclusion of the hunt, after findings have been validated.

Answer

Applying machine learning models

Answer

Creating new user accounts

Answer

Drafting the final incident report

Question 3

Which THREE techniques can be used in Splunk to reduce the noise of false positives during a threat hunt?

Accepted Answer

Using 'NOT' clauses to exclude known administrative processes. Option B is correct because adding 'NOT' clauses to a search (e.g., NOT process_name=svchost.exe) filters out known administrative or benign processes, directly suppressing events that would otherwise generate false positives during a hunt. Option D is correct because lookup tables let you maintain an external list of known-good baselines (IPs, hashes, accounts) and exclude them via lookup-based filtering, which is a standard Splunk method for whitelisting trusted activity. Option E is correct because the 'rare' command's threshold parameter controls how infrequently a value must occur to be reported; raising or tuning that threshold prevents low-frequency but legitimate events from being flagged as suspicious. Option A is wrong because deleting raw logs after indexing destroys forensic evidence and is not a noise-reduction technique. Option C is wrong because increasing the search time range expands the data examined and typically increases, not reduces, false positives.

Answer

Deleting raw logs after indexing

Answer

Increasing the search time range

Question 4

Which TWO Splunk features are best for automating the execution of recurring threat hunts?

Accepted Answer

Scheduled Searches. Scheduled Searches (B) are correct because they let you run a saved search automatically on a cron-based schedule, which is exactly how recurring threat hunts are executed without manual intervention. Alert Actions (D) are correct because they attach automated responses to triggered alerts, such as running a script, sending an email, or invoking a webhook, enabling the hunt to act on findings automatically. Data Model Acceleration (A) only speeds up searches against data models; it does not schedule or automate hunt execution. User Roles (C) govern access permissions and capabilities, not recurring task automation. Splunk Web Framework (E) is a development toolkit for building custom apps and dashboards, not a scheduling or automation mechanism for recurring hunts.

Answer

Data Model Acceleration

Answer

User Roles

Answer

Splunk Web Framework

Question 5

When designing a threat hunting playbook, which TWO components must be included to ensure the hunt is actionable?

Accepted Answer

Detailed SPL search queries. Option C is correct because a threat hunting playbook must contain detailed SPL (Search Processing Language) queries so analysts can actually execute the hunt against SIEM data in Splunk and pivot on the specific fields, indicators, or behaviors being sought; without concrete queries the hunt is theoretical rather than actionable. Option E is correct because incident response escalation steps define what happens when a hunt uncovers malicious activity — who is notified, within what timeframe, and through which channels — which converts a detection into a coordinated, actionable response rather than an unaddressed finding. Options A, B, and D do not belong: the security department budget is a management concern, not a hunt execution component; a network topology map can provide useful context but is not a required element for making a hunt actionable; and a list of all employees is an HR/PII inventory that does not drive hunt execution or escalation.

Answer

The budget for the security department

Answer

A copy of the company's network topology map

Answer

A list of all employees in the company

Question 6

You are hunting for anomalous PowerShell activity. Which THREE indicators or behaviors should you look for in your Splunk data?

Accepted Answer

Presence of '-enc' or '-encodedcommand' flags. Option A is correct because the -enc or -encodedcommand flags let attackers pass Base64-encoded scripts that evade plaintext command-line inspection, a classic sign of obfuscated PowerShell abuse. Option C is correct because PowerShell spawning LOLBins such as wmic.exe or certutil.exe indicates living-off-the-land tradecraft used for reconnaissance, download, or execution, which is highly anomalous for normal admin scripts. Option E is correct because outbound network connections originating from powershell.exe often reveal C2 beaconing, download cradles, or reverse shells, since legitimate PowerShell rarely initiates external connections. Option B is not a strong indicator because Get-Service is a routine, benign cmdlet used constantly by administrators and monitoring tools. Option D is not PowerShell-specific, as RDP logons are a separate authentication event that does not by itself indicate anomalous PowerShell behavior.

Answer

Execution of 'Get-Service' commands

Answer

User logons via RDP

Question 7

During a proactive threat hunt, you want to quickly identify processes that were executed from a temporary directory such as C:\Users\Public on Windows endpoints, using Sysmon data. Which Splunk search is most appropriate to surface this activity?

Accepted Answer

index=sysmon EventCode=1 | where like(Image, "%\Users\Public\%"). Sysmon EventCode 1 is the process creation event and carries the Image field with the full path of the executable. Filtering on the Public directory isolates executions from a location where legitimate software rarely runs, which is a strong indicator of staging or malicious activity and directly supports the hunt hypothesis.

Answer

index=sysmon EventCode=11 | where like(TargetFilename, "%Public%")

Answer

index=sysmon EventCode=3 | where like(DestinationIp, "%Public%")

Answer

index=sysmon | stats count by Image | where count < 5

Question 8

You are hunting for Kerberoasting activity in your Windows environment. You have Splunk ingesting Windows Security event logs. Which Event ID and field combination best supports identifying accounts requesting service tickets with weak encryption?

Accepted Answer

Event ID 4769 with TicketEncryptionType=0x17 and ServiceName not ending in $. Kerberoasting involves requesting Kerberos service tickets for accounts with SPNs and then cracking them offline. Event ID 4769 records these requests, and RC4 encryption type 0x17 is the weak cipher attackers prefer. Filtering out machine accounts ending in $ narrows results to user accounts, which are the realistic targets.

Answer

Event ID 4771 with FailureCode=0x18

Answer

Event ID 4768 with TicketOptions=0x40810010

Answer

Event ID 4624 with LogonType=3 and AccountName ending in $

Question 9

You are conducting a threat hunt for data exfiltration over DNS. Which TWO Splunk search techniques are most effective for identifying anomalous DNS tunneling activity in your DNS logs? (Choose two.)

Accepted Answer

Use the eventstats command to compute the standard deviation of query counts per host and alert on hosts exceeding three standard deviations.. DNS tunneling hides data in long, high-entropy subdomains and generates abnormal query volumes. Statistical profiling of query length and query count per host identifies deviations from normal DNS behavior without relying on known indicators. These techniques are proactive and can detect new tunneling domains.

Answer

Count the number of unique source IPs per DNS server and alert when the count exceeds a fixed threshold of 100.

Answer

Filter for DNS query types A and AAAA only, then sort by query name alphabetically.

Answer

Search for DNS queries containing the string 'malware' in the query name.

Question 10

You are hunting for evidence of pass-the-hash lateral movement in your environment. Which Windows Security event and field combination is most indicative of this technique?

Accepted Answer

Event ID 4624 with LogonType=3 and LogonProcessName=NtLmSsp. Pass-the-hash uses NTLM authentication with a stolen hash, resulting in network logons. Event ID 4624 with LogonType 3 and LogonProcessName NtLmSsp captures this pattern. While not exclusive to pass-the-hash, it is the most direct indicator among the options and can be correlated with source hosts and account behavior.

Answer

Event ID 4648 with TargetUserName=SYSTEM

Answer

Event ID 4672 with PrivilegeList containing SeDebugPrivilege

Answer

Event ID 4776 with Status=0x0

Question 11

You are hunting for suspicious PowerShell activity on endpoints. You have PowerShell Script Block Logging (Event ID 4104) ingested into Splunk. Which search best identifies scripts that download and execute remote content, a common attacker technique?

Accepted Answer

index=win EventCode=4104 | where like(ScriptBlockText, "%DownloadString%") OR like(ScriptBlockText, "%Invoke-Expression%"). PowerShell Script Block Logging (4104) records the actual script text. Attackers frequently use DownloadString to fetch remote payloads and Invoke-Expression to execute them. Searching for these strings directly identifies the download-and-execute chain, which is a high-fidelity indicator of malicious PowerShell activity.

Answer

index=win EventCode=4103 | stats count by ScriptBlockText

Answer

index=win EventCode=4104 | regex ScriptBlockText="^[A-Za-z0-9+/=]{100,}$"

Answer

index=win EventCode=4104 | where like(ScriptBlockText, "%Get-Process%")

Question 12

During a proactive hunt for Kerberoasting in an Active Directory environment, you ingest Windows Security Event Code 4769 with the service ticket options field available as Ticket_Options. You want to isolate requests made with weak RC4 encryption rather than AES. Which Splunk search best surfaces these potentially malicious service ticket requests?

Accepted Answer

index=wineventlog EventCode=4769 Ticket_Encryption_Type=0x17 | stats count values(Service_Name) by Account_Name. Kerberoasting abuses Kerberos service ticket requests, which are recorded in Security Event Code 4769. Because the attack relies on extracting tickets encrypted with the weaker RC4-HMAC algorithm for offline cracking, filtering on the encryption type value 0x17 and aggregating by account and service name produces a focused list of candidate activity that an analyst can triage further.

Answer

index=wineventlog EventCode=4769 Ticket_Options=0x40810000 | stats count by Account_Name, Service_Name

Answer

index=wineventlog EventCode=4768 Ticket_Encryption_Type=0x17 | stats count by Account_Name, Service_Name

Answer

index=wineventlog EventCode=4769 | where Ticket_Options="AES256" | stats count by Account_Name

Question 13

You are hunting for DNS-based data exfiltration using Splunk, where malware encodes stolen data in subdomain labels of queries to an attacker-controlled domain. Which two search constructs most directly help you quantify abnormally long or high-entropy query names and identify the destination domain being abused? (Choose two.)

Accepted Answer

Use rex to extract the query name into a field, then apply eval len() on the query and stats avg(len) by query to find unusually long names.. DNS exfiltration hides data in the length and variability of subdomain labels, so the strongest hunting constructs extract the query name and quantify its length and the number of unique subdomains per parent domain. Ranking parent domains by these metrics exposes the destination being abused and separates tunneling from ordinary resolution traffic without depending on pre-existing threat intelligence.

Answer

Use the lookup command with a threat intelligence feed of known malicious IP addresses and drop every DNS event whose source is not in the feed.

Answer

Use the dedup command on the query field to remove repeated queries and then count the remaining events per host to determine exfiltration volume.

Answer

Use the transaction command to group all DNS events from a single source IP over a 30-minute window into one event and inspect the raw payload.

Question 14

You are hunting for persistence via Windows scheduled tasks. You have Splunk ingesting Windows Event Logs and Sysmon. Which Event ID and field should you prioritize to detect a newly created scheduled task that runs a suspicious binary?

Accepted Answer

Event ID 4698 with TaskContent containing the binary path. Scheduled task creation is best detected via Windows Security Event ID 4698, which includes the full task definition in TaskContent. This allows you to inspect the executable path and arguments for suspicious binaries. Relying on process creation events may miss tasks created through other interfaces.

Answer

Event ID 4688 with NewProcessName

Answer

Event ID 106 with TaskName

Answer

Event ID 1 with CommandLine containing schtasks

Question 15

While hunting for Kerberos-based attacks, you notice a service account requesting service tickets for many distinct SPNs across multiple servers within a short window. You want to correlate this with the account's normal baseline to confirm abnormal breadth. Which approach most directly supports that analysis in Splunk?

Accepted Answer

Run a search for EventCode 4769, then use eventstats to compute the average number of distinct service names per account over the prior 30 days and compare the current hour against that baseline. Kerberos service ticket requests are logged as EventCode 4769, and the hunt hinges on measuring how many distinct service names a given account requests relative to its own history. Attaching a per-account baseline with eventstats and comparing the current window exposes accounts whose SPN breadth suddenly expands, a pattern consistent with kerberoasting or misuse of a privileged service account.

Answer

Search EventCode 4776 and use stats values(user) by workstation to list accounts validated on each host

Answer

Search EventCode 4768 and use timechart to plot authentication ticket requests per account over 24 hours

Answer

Search EventCode 4624 and use transaction to group logon events by account, then count the number of source workstations per session