SPLK-5001 Timed Practice Test 3 — 10 Questions

Question 1

Which field is mandatory for an event to be correctly categorized by the Common Information Model (CIM) 'Network Traffic' data model?

Accepted Answer

tag. The 'tag=network' and 'tag=communicate' (or similar) tags are required to map events to the Network Traffic data model.

Answer

user

Answer

src_ip

Answer

host

Question 2

You are investigating a potential web-based attack. Which data model contains information regarding HTTP user-agents and request methods?

Accepted Answer

Web. The 'Web' data model captures detailed information about web server traffic, including user-agents.

Answer

Network Traffic

Answer

Authentication

Answer

Endpoint

Question 3

You are reviewing a Splunk Enterprise Security alert mapped to the MITRE ATT&CK technique 'T1059.001 (PowerShell)'. Which search command would best identify the use of obfuscated PowerShell commands?

Accepted Answer

tstats count from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe.. The 'tstats' command is the standard way to query data models efficiently, such as the 'Endpoint' model, to look for malicious PowerShell patterns.

Answer

search sourcetype=sysmon | rename command as powershell.

Answer

| inputlookup mitre_tactics | where process=powershell.

Answer

index=main | lookup mitre_attack_id.

Question 4

You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?

Accepted Answer

index=windows EventCode=4688 | stats count by ParentProcessName, ProcessName. Identifying abnormal parent-child relationships is a core hunting technique. Using tstats to aggregate process parent-child pairs is efficient.

Answer

index=windows EventCode=4697 | table User, ServiceName

Answer

index=windows EventCode=4624 | table Logon_Type, User

Answer

index=windows EventCode=7045 | stats count by ServiceName

Question 5

Which THREE techniques can be used in Splunk to reduce the noise of false positives during a threat hunt?

Accepted Answer

Using 'NOT' clauses to exclude known administrative processes. Filtering known-good values, using lookup tables for exclusions, and weighting alerts are all standard methods for noise reduction.

Answer

Deleting raw logs after indexing

Answer

Increasing the search time range

Question 6

When reviewing an incident, how can an analyst verify if the notable event was generated by a specific correlation search?

Accepted Answer

By checking the 'Search Name' field.. The 'Search Name' field in the Incident Review dashboard clearly identifies the correlation search that triggered the notable.

Answer

By running a search for the object.

Answer

By checking the 'Event ID'.

Answer

By looking at the index name.

Question 7

What is the effect of changing the 'Retention Period' in the Enterprise Security app settings?

Accepted Answer

It determines how long data remains in the Notable event storage.. This controls how long the KV Store and index data associated with ES remain available before being purged or aged out.

Answer

It changes the user access level.

Answer

It changes the search speed.

Answer

It increases the license limit.

Question 8

When hunting for lateral movement, which THREE data sources are most valuable for correlation?

Accepted Answer

Windows Security Event ID 4688 (Process Creation). Authentication logs (4624), process execution (4688), and service installation (7045) provide the necessary context to track an attacker moving between hosts.

Answer

Windows System Event ID 104 (Log Cleared)

Answer

Windows Security Event ID 4611 (Trusted Logon)

Question 9

A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?

Accepted Answer

Access Anomalies. The Access Anomalies dashboard provides a centralized view of authentication-related anomalies.

Answer

User Activity Center

Answer

Protocol Intelligence

Answer

Threat Intelligence Activity

Question 10

If an analyst wants to see all risk events associated with a specific IP address, which search command is most effective?

Accepted Answer

tstats count from datamodel=Risk where Risk.src_ip=.... The 'tstats' command is the most efficient way to query the risk data model for events associated with a specific field value.

Answer

collect index=risk

Answer

lookup asset_info

Answer

search index=risk src_ip=...