SPLK-1002 Transactions and Event Correlation Practice Question
Exhibit
index=firewall src_ip=10.0.0.1 | transaction src_ip startswith="action=allow" endswith="action=deny" maxspan=5m | table _time, src_ip, action
Refer to the exhibit. A security analyst runs the above search. Which of the following best describes the result?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Transactions beginning with 'allow' and ending with 'deny' for src_ip 10.0.0.1, with a maximum duration of 5 minutes
The transaction command groups events by src_ip=10.0.0.1 with startswith='allow' and endswith='deny' and a maxspan of 5 minutes. This forms transactions that begin with an 'allow' event and end with a 'deny' event within a 5-minute window for that source IP. Option A is incorrect because the search filters events for src_ip 10.0.0.1 only, not all source IPs. Option B is incorrect because it describes transactions of all firewall events, but the start and end conditions restrict the events filtered. Option C is incorrect because it reverses the start and end conditions (start with deny, end with allow) whereas the search specifies start with allow and end with deny.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Transactions for all source IPs, but only showing src_ip 10.0.0.1 in the table
Why it's wrong here
The index filter and src_ip transaction field limit to that IP; maxspan is 5 min, not 1 hour.
- ✗
Transactions of all firewall events for src_ip 10.0.0.1, each lasting up to 5 minutes
Why it's wrong here
Not all events; only those matching start and end conditions.
- ✗
Transactions of src_ip 10.0.0.1 that start with deny and end with allow
Why it's wrong here
The startswith and endswith are reversed.
- ✓
Transactions beginning with 'allow' and ending with 'deny' for src_ip 10.0.0.1, with a maximum duration of 5 minutes
Why this is correct
Correct interpretation of the transaction parameters.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1002 question from scratch — 475 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1002 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1002 exam.