203 questions total · 3pages · All types, answers revealed
Page 1 of 3
Page 2Which TWO of the following are key components of a successful incident investigation workflow in Splunk ES?
Documenting findings is critical for auditability and collaboration.
Why this answer
Triage and documentation are essential parts of the Incident Review and Case Management process.
Which THREE tasks are performed within the 'CIM Setup' interface?
Mapping is the primary function of CIM Setup.
Why this answer
CIM Setup allows administrators to map sourcetypes to data models, enable acceleration, and verify CIM compliance.
What is the purpose of the 'head' command?
Head limits results to the beginning of the list.
Why this answer
The 'head' command returns the first N results from a search.
An attacker is using a technique that involves 'living off the land' by utilizing legitimate system tools. Which data model is most effective to monitor these tools?
The Endpoint data model captures execution of tools, making it the primary tool for detection.
Why this answer
The Endpoint data model captures process execution, which is the primary indicator of living-off-the-land techniques.
You are configuring the Splunk Security Essentials (SSE) app to align with the NIST CSF framework. You want to prioritize your detection development based on the most critical gaps. Which action should you take?
This tab maps installed detections against NIST CSF and shows maturity scores.
Why this answer
The 'Content Introspection' or 'Security Content' dashboard in SSE allows users to filter by framework and maturity to identify coverage gaps.
You need to ensure that only authorized users can view certain sensitive notable events. How do you implement this in Splunk ES?
Access control is fundamentally managed via index-level role permissions.
Why this answer
Data model-based security and index-level access controls are used to restrict visibility to events based on user roles.
When drafting a threat hunting playbook, which of the following sections is most critical for ensuring the hunt is repeatable and auditable by other analysts?
Clear steps and query logic ensure the hunt can be audited and repeated.
Why this answer
A documented 'Procedure' or 'Steps' section ensures that the methodology is clear and can be executed consistently by others.
A security engineer is configuring a new correlation search that needs to correlate data across two different indexes. Which Splunk ES feature allows for efficient correlation across large datasets?
Acceleration creates summary indexes for data models, which are optimized for correlated searches.
Why this answer
Data model acceleration allows Splunk to pre-calculate and store data models, making correlation searches run significantly faster than raw searches across indices.
Which TWO of the following commands are used for data transformation or enrichment?
Used for data enrichment.
Why this answer
Lookup and eval are core transformation commands.
Which phase of the proactive threat hunting methodology involves identifying the specific threat actor or technique to be investigated?
This is the starting phase where the hunt focus is established.
Why this answer
The 'Hypothesis Generation' phase involves determining what to hunt for based on threat intelligence or environmental observations.
A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?
These are the entry points for most 'Initial Access' vectors.
Why this answer
Initial Access often occurs via phishing or exploited public-facing applications, making web or email logs primary investigation targets.
Which character acts as a wildcard in a search string?
The asterisk represents any number of characters.
Why this answer
The asterisk (*) is the standard wildcard character in Splunk.
A user reports that a specific dashboard panel is timing out. After checking the search job, you notice it is scanning too much data. Which configuration should you adjust?
Summaries drastically reduce the data scanned by the search engine.
Why this answer
Adjusting the time range picker or optimizing the search by using specific indexes or summaries will reduce scan volume.
You are investigating a potential beaconing pattern. You have identified a suspect destination IP. Which SPL command sequence is most appropriate to calculate the frequency of connections to this IP to validate the beaconing hypothesis?
Calculating the time difference between consecutive events is the standard method for finding periodic beaconing.
Why this answer
The streamstats command allows for calculating intervals between events, which is critical for identifying beaconing patterns in network traffic.
When configuring an 'Adaptive Response' action, what does the 'Notable' action type do?
This is the primary function of the 'Notable' adaptive response action.
Why this answer
The 'Notable' action type specifically triggers the creation of a notable event in the Incident Review dashboard.
Which Splunk Enterprise Security feature allows you to manage the lifecycle of a notable event?
Incident Review is the primary console for managing event status.
Why this answer
The Incident Review dashboard provides the interface for managing statuses, owners, and comments for notable events.
An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?
The file_hash field allows for immediate investigation into file reputation.
Why this answer
The file_hash field is the standard normalized field in Splunk ES for tracking file identities across data sources.
You are using a subsearch to find 'dest_ip' values that appeared in a 'failed_login' search. What is a common limitation of subsearches that you must consider?
The subsearch must complete within a specific time and result limit before the outer search runs.
Why this answer
Subsearches have a limit on the number of results returned (default 10,000) and a time limit.
Which THREE pieces of information are commonly found in a Splunk ES Case?
Metadata keeps track of case state and assignment.
Why this answer
Cases are containers that hold key artifacts, comments from analysts, and links to relevant notable events.
Which TWO factors influence an object's final risk score in Splunk ES?
These are the base values that get added together.
Why this answer
The final score is influenced by the individual event scores and the aggregation method applied.
Which TWO commands provide information about the fields present in the events?
Controls visibility of fields.
Why this answer
Fields and table can show which fields exist.
Which dashboard in Splunk ES provides a high-level view of threats and vulnerabilities mapped to the MITRE ATT&CK framework?
The Security Posture dashboard shows framework-based threats.
Why this answer
The Security Posture dashboard and the MITRE ATT&CK mapping dashboard are standard features for viewing framework coverage.
An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?
The 'Add to Case' action is directly available in the Incident Review interface.
Why this answer
From the Incident Review dashboard, analysts can select a notable event and use the 'Action' menu to assign it to an existing case.
Which THREE dashboard categories in Splunk ES are most useful for risk-based investigation?
This provides granular risk scoring data.
Why this answer
Risk Analysis, Incident Review, and Security Posture are the primary dashboards for investigation.
Which THREE components are required for an Adaptive Response action to function?
If disabled, the action will not trigger.
Why this answer
Adaptive response requires an enabled action, a configured Add-on (for the target system), and proper credentials.
You are creating a custom Adaptive Response action. The action requires a Python script. Where must this script be placed for the Splunk instance to execute it?
Scripts for custom actions reside in the application's bin folder.
Why this answer
The script must be placed in the 'bin' directory of the specific Add-on or app directory to be accessible by the Splunk search process.
You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?
Mapping the owner field to an extraction ensures dynamic assignment.
Why this answer
The 'drilldown_field' and 'owner' field mapping in the notable event configuration allow for dynamic assignment based on extracted fields.
When designing a threat hunting playbook, which TWO components must be included to ensure the hunt is actionable?
The query is the core tool of the hunt.
Why this answer
Actionable hunts require clear search queries and defined 'next steps' for when a hit is found.
An attacker has cleared the Windows Event Logs to hide their tracks. You are hunting for this activity. Which Event ID in the System log indicates that the log service was stopped or cleared?
Indicates the audit log was cleared.
Why this answer
Event ID 1102 is the specific Windows event logged when the Security audit log is cleared.
You are investigating a user who has triggered multiple high-risk alerts. Where in Splunk ES can you view the historical risk score progression for this specific user?
The Risk Analysis dashboard shows historical risk progression for users and assets.
Why this answer
The 'Risk Analysis' dashboard displays the risk score trend for entities over time.
Which THREE actions are part of the 'Incident Review' investigation workflow?
Updating status shows progress in the lifecycle.
Why this answer
Investigating involves triaging, assigning, and changing statuses.
Which THREE of the following data sources are most valuable for detecting an insider threat?
Tracks sensitive data access.
Why this answer
Insider threats are best monitored through access logs, file activity, and email traffic.
What is the effect of changing the 'Retention Period' in the Enterprise Security app settings?
Retention policies define the lifespan of the event data.
Why this answer
This controls how long the KV Store and index data associated with ES remain available before being purged or aged out.
You are hunting for anomalous PowerShell activity. Which THREE indicators or behaviors should you look for in your Splunk data?
These are standard indicators of obfuscated PowerShell scripts.
Why this answer
Obfuscation (encoded commands), network callbacks, and unusual execution paths are classic signs of PowerShell abuse.
Which command is used to calculate the 'count' of events and concurrently keep the original 'raw' text?
Eventstats adds the calculated field to the original events without discarding the raw text.
Why this answer
The 'stats' command discards the raw text, so you need 'eventstats' if you want to keep the raw events.
When reviewing an incident, how can an analyst verify if the notable event was generated by a specific correlation search?
This field maps the notable event to the originating correlation search.
Why this answer
The 'Search Name' field in the Incident Review dashboard clearly identifies the correlation search that triggered the notable.
You have a field 'raw_data' containing JSON. How do you extract fields from it within your SPL search?
The spath command automatically parses JSON if the input is valid.
Why this answer
The 'spath' command is specifically designed to parse JSON or XML data.
What is the purpose of the 'map' command in complex searches?
Map iterates through results and runs a search for each one.
Why this answer
The 'map' command executes a search for each event in the results.
What is the purpose of the 'Investigation Workbench' in Splunk ES?
It helps consolidate investigation data for analysts.
Why this answer
The Investigation Workbench provides a centralized view of all entities, events, and context related to a specific incident.
When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?
This dashboard displays the breakdown of risk scores by object and contributing events.
Why this answer
The Risk Analysis dashboard allows analysts to drill down into the specific risk events contributing to a user's total risk score.
What is the purpose of the 'Assets and Identities' framework in Splunk ES?
Enrichment provides necessary context for investigation.
Why this answer
This framework enriches events with contextual information such as business unit, ownership, and priority.
Which THREE of the following are necessary prerequisites for ensuring a new data source is correctly utilized by the ES 'Access' data model?
CIM tagging is mandatory for data model mapping.
Why this answer
Normalization via CIM tags, correct sourcetype identification, and ensuring the data model is accelerated are standard prerequisites for ES data models.
Which THREE of the following represent the categories of threat intelligence that can be managed within the Splunk Enterprise Security 'Threat Intelligence' framework?
Domains are a primary type of IoC for C2 detection.
Why this answer
ES allows for the management of Indicators of Compromise (IoCs) including IP addresses, file hashes, and domain names.
A user account is exhibiting signs of being compromised. Where can you find the user's recent login history in Splunk ES?
This dashboard aggregates user-specific behavior including login history.
Why this answer
The User Activity dashboard or the Authentication data model is designed to show user-specific login trends.
Which TWO actions should be taken if a correlation search is consuming too many system resources?
Running the search less often reduces cumulative load.
Why this answer
Optimizing the search query and reducing the search frequency (cron) are the primary ways to reduce resource impact.
You are configuring Splunk Enterprise Security to monitor for MITRE ATT&CK 'Persistence' techniques. Which TWO data sources provide the highest fidelity logs for detecting registry-based persistence?
These monitor Registry object creation and value modification.
Why this answer
Registry modifications are typically captured by Sysmon (Event ID 12/13) or local Windows Event logs.
In the Incident Review dashboard, what does 'Status' represent?
Status indicates where the incident is in the response process.
Why this answer
Status tracks the progress of an investigation, such as 'New', 'In Progress', or 'Closed'.
Which command is used to visualize data in a time-series chart?
Timechart is the standard command for aggregation over time.
Why this answer
The 'timechart' command is specifically for time-series visualization.
You want to find the total count of events per hour over the last week. Which command sequence is most efficient?
Binning time into hours and then counting is standard.
Why this answer
Using 'bin' followed by 'stats' is the most efficient pattern.
When using the 'Risk Analysis' framework in Splunk ES, what is the primary benefit of assigning a 'Risk Object'?
Risk analysis helps in detecting patterns across different alert types.
Why this answer
Assigning a risk object (like a user or system) allows for the aggregation of multiple low-fidelity alerts into a single actionable risk score.
A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?
Notable Event Suppression allows analysts to define criteria to ignore specific events that should not trigger a notable.
Why this answer
Notable event suppression is the native method in Splunk ES to prevent specific event types from triggering notables based on criteria.
You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?
The framework allows you to ingest lists of known malicious IPs and match them against logs.
Why this answer
Threat Intelligence Framework allows for the ingestion of threat intelligence lists like TOR exit nodes.
What is the primary function of the 'Incident Review' dashboard in Splunk ES?
It is the central point for triage and investigation of notable events.
Why this answer
Incident Review is the command center for investigating, assigning, and status-tracking notable events.
When utilizing the Splunk Common Information Model (CIM), which field name is standard for identifying the destination IP address across different data sources?
'dest' is the mandated field name for destinations in the CIM.
Why this answer
The CIM 'Network Traffic' data model standardizes the destination IP field as 'dest' to ensure cross-source compatibility.
You want to dynamically update a lookup table with new indicators of compromise (IOCs) found during your search. Which command is used for this?
Outputlookup writes the current results to the specified CSV file.
Why this answer
The 'outputlookup' command writes search results to a lookup file.
You notice a system process attempting to connect to a suspicious external domain. Which CIM data model would contain this network connection information?
Contains the network connection data required to investigate external communications.
Why this answer
The Network Traffic data model contains information about network connections, including source/destination IP, port, and protocol.
What is the result of using 'bin _time span=1d'?
Binning 'span=1d' creates daily time windows.
Why this answer
Binning the time field rounds down to the nearest day.
Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?
This is the tool used to create custom security logic.
Why this answer
The Correlation Search editor allows users to define custom search logic against threat intelligence lists.
Which TWO actions should be performed during the 'Data Preparation' phase of a threat hunt to ensure accurate results?
CIM normalization is critical for cross-source search effectiveness.
Why this answer
Ensuring data is mapped to the CIM and that the required fields are available are essential for reliable hunting.
Which TWO metrics are tracked in the 'Incident Review' dashboard's 'Notable Event' list?
Severity is a core column used for prioritization.
Why this answer
The dashboard displays core event information, including status and severity.
An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?
Endpoint data is required to map process names to their file paths.
Why this answer
The Endpoint data model contains the 'process_path' and 'process_name' fields required for this comparison.
Which THREE features are provided by the Splunk ES Incident Review dashboard?
Analysts update the status of the investigation here.
Why this answer
The Incident Review dashboard is the hub for notable event triage, status tracking, and assignment.
Which field is mandatory for an event to be correctly categorized by the Common Information Model (CIM) 'Network Traffic' data model?
Tags are the primary mechanism for CIM mapping.
Why this answer
The 'tag=network' and 'tag=communicate' (or similar) tags are required to map events to the Network Traffic data model.
An attacker is attempting to use a 'Pass-the-Hash' technique. Which authentication log event code in Windows (Event ID 4624) should you look for to detect this?
Event ID 4624 records successful logins, which is key for identifying pass-the-hash.
Why this answer
Event ID 4624 with Logon Type 3 (Network) or 9 (NewCredentials) is often associated with pass-the-hash attacks.
Which THREE things are required for Splunk Enterprise Security to provide meaningful security insights?
Context turns raw logs into actionable intelligence.
Why this answer
Success requires indexed data, normalized data (CIM), and contextual information (Assets/Identities).
If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?
The Index Manager is the correct place to adjust retention settings for any index, including the risk index.
Why this answer
Index retention policies are managed in the Splunk index settings (indexes.conf) or via the Manager interface.
Where do you go in Splunk ES to adjust the sensitivity (risk score) of a specific correlation search?
This allows you to modify the alert action, including the risk score assigned.
Why this answer
The 'Correlation Search' settings allow for modifying the risk score assigned to notable events.
Which THREE of the following components are part of the 'Endpoint' data model?
Tracks commands and process execution.
Why this answer
The Endpoint data model encompasses file activity, process execution, and registry changes.
You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?
Risk Analysis aggregates risk events for entities, which is perfect for long-term insider threat tracking.
Why this answer
Risk-Based Alerting (RBA) or Risk Analysis allows for aggregating risk scores over time for entities.
You are using 'lookup' to add user info. What happens if the common field doesn't exist in the lookup file?
Lookup matches are non-binding by default, so unmatched events remain.
Why this answer
The lookup command leaves the output fields null for those events.
Which TWO methods can be used to suppress unwanted notable events?
This allows the search itself to exclude certain patterns.
Why this answer
Notable event suppression and correlation search suppression are the standard ways to manage alert noise.
Which TWO factors are critical for effective Asset and Identity enrichment?
Inaccurate sources lead to poor enrichment.
Why this answer
The quality of the input data (CSV/KV Store) and the accuracy of the matching fields (like IP or user) are critical.
You are configuring a 'Notable Event' to use a specific 'Drilldown' link. What syntax is used to pass fields from the event into the URL?
The $var$ syntax is standard for passing tokens in Splunk.
Why this answer
Using the dollar sign syntax ($field_name$) allows for dynamic substitution of event fields into the drilldown URL.
When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?
Incident Review is the primary location for managing, documenting, and closing incidents.
Why this answer
The 'Incident Review' dashboard and the 'Notable Event' workflow actions allow for the documentation and categorization of incident resolution and recovery steps.
Which TWO factors directly impact the urgency of a notable event in Splunk ES?
The risk score is a direct input for urgency.
Why this answer
Urgency is calculated by combining the event's inherent risk score and the criticality of the system or user (asset) involved.
Page 1 of 3
Page 2Practice SPLK-5001 by domain
Target a specific domain to shore up weak areas.