Splunk Certified Cybersecurity Defense Analyst (SPLK-5001) (SPLK-5001) (SPLK-5001) — Questions 1–75

Case documentation and updates provide the auditable record of an investigation, capturing evidence, findings and actions as they evolve. This satisfies the workflow requirement for traceable incident handling, ensuring analysts can hand over, review and report on progress within Splunk ES.

The Identity Investigator is a Splunk ES tool that displays identity details such as role, department, and watchlist status from the identity lookup. This helps the analyst understand the user's importance and whether they are on a watchlist, which informs the potential impact. It is the appropriate tool for identity enrichment.

The lookup command matches the dest_ip field in the events against the lookup table's key field and outputs the owner and department fields. Because the lookup is defined in transforms.conf, the filename reference works and the OUTPUT clause specifies exactly which fields to add. This is the correct way to enrich events with the asset ownership data.

Mapping sourcetypes to data models is a core CIM Setup task: the interface binds each sourcetype's fields to the Common Information Model's normalised schema, so that data model acceleration and downstream correlation searches return consistent, vendor-neutral results across heterogeneous sources.

The `head` command returns the first N results from a search, satisfying the requirement to limit output to the earliest events in the result set. Unlike `tail`, which returns the last N results, `head` preserves the original sort order and truncates from the beginning, making it the precise tool for previewing initial results.

The Endpoint data model normalises process, file and registry telemetry, letting you detect misuse of legitimate binaries like PowerShell or certutil. It satisfies the stem's living-off-the-land constraint because process-level visibility is essential to spotting abused system tools.

Event ID 4698 is generated when a scheduled task is created and includes details such as the task name and the account that registered it. Reviewing it directly surfaces newly created persistence mechanisms and lets you correlate the creating account with suspicious activity. It is a primary artifact for scheduled-task persistence hunting and pairs well with task content analysis.

This search filters for Event Code 4769 (Kerberos service ticket request) with encryption type 0x17 (RC4-HMAC), which is commonly used in Kerberoasting because it is weaker and easier to crack. It then aggregates by Account_Name (the user requesting the ticket) and Service_Name (the SPN), directly identifying which accounts are requesting service tickets for which services, highlighting potential Kerberoasting activity.

Identity Investigator provides a unified view of a user's activity across various data sources, including authentication and VPN logs. It is specifically designed to help analysts quickly assess user behavior and investigate notable events related to identities, making it the correct tool for this scenario.

Event Code 4769 records Kerberos service ticket requests, and the encryption type field value 0x17 (decimal 23) indicates RC4-HMAC. Attackers performing Kerberoasting commonly request RC4-encrypted service tickets because they are easier to crack offline, so filtering on this value and aggregating by account and service name directly isolates the suspicious pattern.

Documenting the procedure and the exact SPL queries lets another analyst rerun the same hunt and reproduce findings. This satisfies the stem's repeatability and auditability requirement, since the query logic records precisely what was searched and how results were interpreted.

This search applies a time filter with earliest=-24h to restrict events to the last 24 hours. It then uses stats with dc(src_country) to count distinct countries per user and filters for users with more than three distinct countries. This directly meets the requirement and is efficient.

This search aggregates DNS queries by source IP and queried domain, then sorts descending by count. A high count for a single external domain from an internal host is a strong indicator of DNS tunneling, where data is exfiltrated via repeated queries. It directly surfaces the volume and target domain needed to confirm the behavior.

Pass-the-hash authentication often uses NTLM, which logs as LogonType 3 (network) with LogonProcessName NtLmSsp. This combination indicates a network logon using NTLM, which is characteristic of hash-based authentication. It is a strong starting point for identifying lateral movement via stolen hashes.

Data Model Acceleration precomputes and stores summaries of indexed data, letting correlation searches query those summaries instead of scanning raw events across indexes. This satisfies the stem's large-dataset efficiency requirement, since correlation speed no longer depends on raw index volume.

The lookup command enriches events by matching fields against an external lookup table or KV Store collection, appending additional columns. This satisfies the enrichment criterion because it adds context from outside the raw event stream during search-time processing.

coalesce merges dest_host and fqdn into one domain field regardless of which index supplied it, and stats groups by src_ip and domain while collecting the distinct indexes. Filtering with where mvcount(sources)>1 keeps only combinations observed in both proxy and firewall data, precisely the intersection the analyst needs.

The rex command extracts fields using regular expressions. The pattern '^https?://([^/]+)' captures the domain part of the URL (everything after the protocol and before the first slash). This effectively isolates the domain, such as 'www.example.com', which can then be used for frequency analysis.

The Risk Event link in a notable's detail view is designed exactly for this pivot. It launches a search against the risk index filtered to the risk object(s) tied to the notable, letting the analyst see every contributing risk event. This is the intended workflow for moving from an aggregated notable to its underlying risk events without manually constructing a search.

Hypothesis Generation is the phase where hunters formulate a testable proposition about a specific threat actor or technique, defining what to investigate before data collection begins. It directly satisfies the stem's requirement to identify the actor or technique, preceding data gathering and analysis phases.

Initial Access covers techniques such as phishing and drive-by compromise, which arrive via email attachments, links, or malicious web content. Email security and web proxy logs record those delivery vectors, giving the primary evidence needed to trace how the intrusion began.

The Incident Review dashboard in Splunk Enterprise Security is designed for triaging notable events. It allows analysts to filter by owner, status, urgency, and other fields, and to take actions such as assigning, commenting, and closing notables. This dashboard is the central place for managing notable events and is exactly where an analyst would go to see their open assignments.

Optimising the query and using data model summaries directly reduces the data scanned, satisfying the stem's excessive-scan constraint. Data model summaries pre-compute aggregated results, so the search reads accelerated summary data rather than raw events, cutting scan volume and resolving the timeout.

The Authentication data model in Splunk ES captures login events, including successful and failed attempts, from various sources like Windows Security logs, VPNs, and SSO providers. It includes fields such as user, src, dest, and action, which allow analysts to review the pattern of failed logins and determine if they indicate a brute force attack. This data model is the correct choice for investigating account lockouts.

The Notable action type writes an entry into the Incident Review dashboard, generating a notable event with its severity, owner and status fields so analysts can triage it. It does not itself perform containment or enrichment on the originating host.

streamstats with window=1 and current=f computes a running statistic over preceding events, so last(_time) captures the prior event's timestamp within each src_ip group. Subtracting it with eval yields the per-event gap while raw events remain visible, and sorting by _time ensures correct chronological order.

Incident Review provides the central console where analysts triage notable events, changing status, owner, urgency and disposition. This workflow directly manages each notable's lifecycle from detection through assignment to closure, satisfying the requirement to govern event handling.

The `file_hash` field carries the cryptographic digest of the attachment, which is the primary pivot key the 'File' domain dashboard queries against. It satisfies the stem's requirement for pivoting to file-centric investigation, since Splunk ES correlates hashes across endpoints and sandboxes to reveal execution, prevalence and verdict data.

This search targets the specific command-line patterns that indicate LOLBin abuse, such as certutil with -urlcache or -decode, and bitsadmin with -transfer. Matching on the combination of a signed binary and a remote-download or decode switch isolates the technique while producing a reviewable list of events with full context.

Subsearches run first and their results are injected into the outer search, so they are bounded by the maxout setting (default 50,000 results) and the subsearch execution time limit. Exceeding either silently truncates results, which is the constraint to consider here.

The Risk Analysis dashboard in Splunk Enterprise Security aggregates risk events and displays risk scores by risk object, such as users and systems. It provides a ranked view of the highest-risk entities, exactly what the manager needs to assess overall risk posture.

Splunk ES cases record investigation metadata such as status and owner, letting analysts track who is handling the case and its current stage. This administrative context is a standard component of case data, satisfying the question's requirement for commonly found information.

Adaptive Response in Splunk ES enables automated and manual actions to be taken directly from notable events, such as blocking an IP on a firewall or disabling a user account in Active Directory. It maps directly to the NIST CSF Respond function by providing the capability to contain and mitigate incidents quickly. This feature integrates with third-party tools via adaptive response actions.

T1078 Valid Accounts describes adversaries obtaining and using credentials of existing accounts to gain access, escalate privileges, and move laterally. It is a precise match because the scenario emphasizes legitimate credentials, which are often undetected by traditional defenses. Mapping to this technique helps analysts focus on anomalous account usage rather than exploit-based intrusions.

This is correct because the observed behavior is PowerShell executing an encoded, download-and-execute payload, which is the canonical definition of T1059.001. Splunk ES maps this through the Endpoint data model's process and script-block fields, and the encoded command is a hallmark of PowerShell abuse for execution and defense evasion within that technique.

Each contributing risk event carries its own score, and the object's final value derives from those individual contributions. This satisfies the question directly: without the underlying event scores there is nothing for the aggregation logic to combine into a final risk score.

Within Incident Review, selecting the event and choosing 'Add to Case' attaches that event to an existing case, preserving its evidence linkage. This is the manual procedure for enriching an open investigation without creating a new case.

Assigning a security domain (such as Access, Endpoint, Network, etc.) helps categorize the notable events and enables filtering and reporting in the Incident Review dashboard. It is a recommended practice to ensure that the events are properly classified for later analysis and response. This action directly supports tracking and categorization.

An Adaptive Response action only fires when explicitly enabled; a disabled action remains configured but never executes. This satisfies the stem's requirement for a mandatory component, alongside a triggering correlation search and a defined response action type.

Placing the script in the app's bin directory satisfies Splunk's requirement that custom Adaptive Response scripts reside within the app's own directory structure. Splunk executes binaries from `$SPLUNK_HOME/etc/apps/<app_name>/bin`, so this path guarantees the Python script is discoverable and runnable by the instance.

Mapping the notable event's owner field to an extracted user field assigns each event to the relevant user, so distinct users triggering the same correlation search retain correct ownership instead of a single static value.

Detailed SPL search queries translate a hunting hypothesis into executable searches across indexed data, satisfying the requirement that the playbook be actionable rather than merely conceptual. They specify the exact fields, commands and time windows analysts run, ensuring consistent, repeatable detection of the targeted adversary behaviour during the hunt.

This search calculates the length of each DNS query, filters for queries longer than 50 characters (common in tunneling), then counts by source IP and filters for high volume. DNS tunneling often uses long, encoded subdomains to exfiltrate data, so this combination of length and frequency effectively surfaces suspicious hosts.

bytes_out represents the number of bytes sent from the client to the server, which directly measures outbound data volume. In the context of data exfiltration, a high bytes_out value to an external site indicates that an internal host is uploading a significant amount of data. This field is the most relevant for identifying potential exfiltration, as it quantifies the data leaving the network.

The threat intelligence data model in Splunk Enterprise Security stores indicators and their associated context, and pivoting on an indicator lets the analyst review every event linked to it across the index retention period. This directly answers whether the indicator has been seen, using existing indexed data without waiting for new detections or building additional correlation logic.

The Threat Intelligence Framework uses Splunk configuration files, such as threat_intelligence.conf, to define threat intelligence sources, including STIX/TAXII feeds. These .conf files specify the TAXII server URL, collection, and other parameters. This is the correct file type for configuring the source.

Risk Analysis aggregates risk events per entity over time, letting you chart the historical risk score progression for the specific user rather than only current totals. This directly satisfies the requirement to view that user's score history across the triggered high-risk alerts.

Changing a notable's status is a core Incident Review action, moving events through triage states such as New, In Progress and Closed. This satisfies the workflow requirement by recording analyst decisions and tracking resolution progress directly on the notable event.

Endpoint file activity records local file creation, modification and access on hosts, exposing the collection or staging behaviour typical of insider data theft. This satisfies the requirement for a data source that reveals internal misuse rather than perimeter intrusion.

The Retention Period setting controls how long notable events persist in the notable index before ageing out. It governs storage duration only, not search scheduling or correlation logic, satisfying the requirement to determine how long notable event data remains available.

The severity displayed on a finding in Incident Review is taken from the severity field configured in the correlation search's alert action settings. Even if the underlying risk score is moderate, the correlation search can explicitly assign a severity value such as 'high', which overrides any score-derived severity and is what the analyst sees on the notable.

Base64-encoded commands hide intent from casual inspection, so '-enc' or '-encodedcommand' flags in process command lines are a high-fidelity anomaly indicator. This satisfies the scenario's need for behavioural indicators detectable directly within Splunk process-execution telemetry.

Fileless attacks leave traces in process behavior, not files. The Endpoint data model captures process creation, parent-child relationships, and command lines, so spotting a script interpreter like PowerShell or wscript spawning from a document reader and then making network connections is a strong indicator. This matches the in-memory execution pattern.

Each notable event carries a Search Name field populated by the correlation search that produced it, letting analysts trace provenance directly. Checking this field confirms which specific correlation search fired, satisfying the stem's verification requirement without inspecting saved search configurations manually.

Adaptive Response in Splunk ES enables automated or manual actions in response to notable events, such as blocking an IP on a firewall or disabling a user account. This directly supports the 'Respond' function by providing the capability to take action against threats. It integrates with various security tools to execute response actions, making it a core component of incident response in Splunk ES.

spath parses structured data such as JSON and XML, extracting nested fields into searchable fields. Specifying input=raw_data tells Splunk to read that field's JSON content and expose each key as a field for use in the SPL pipeline.

The 'map' command executes a subsearch once per input result, substituting each event's field values into the subsearch via tokens such as $field$. This per-event iteration satisfies the stem's requirement for complex searches, letting you enrich or correlate each result individually rather than running one aggregate subsearch across the whole set.

The Investigation Workbench consolidates artefacts — notable events, contributing events, assets, identities and threat intelligence — into a single pane, satisfying the stem's requirement for a unified incident view. Analysts pivot across these linked artefacts without switching searches, which is precisely the centralised triage capability Splunk ES intends this interface to deliver.

The Risk Analysis Dashboard visualises risk contributors per user, satisfying the stem's requirement for a user-specific view of contributing risk factors. It aggregates risk events by risk object, showing which detections and sources drive a user's score, unlike the Incident Review or Risk Notables views.

The Risk Analysis framework in Splunk ES allows you to assign risk scores to entities (users, systems, etc.) based on events. It uses risk rules to calculate and modify risk scores, which can then be used in correlation searches to trigger notables when a threshold is exceeded. This is the correct feature for automatically adjusting risk scores based on events. It provides a dynamic risk posture and is integral to risk-based alerting.

The Assets and Identities framework enriches security events with contextual metadata such as department, role, priority and business unit, satisfying the stem's requirement to explain its purpose. This context lets Splunk ES correlate notable events against asset criticality and identity attributes, improving risk scoring and investigation triage.

Domain names are a supported threat intelligence category in the Splunk Enterprise Security framework, satisfying the stem's requirement. They populate the intel store for correlation against DNS and web proxy events, enabling detection of command-and-control, phishing and malicious infrastructure lookups.

User Activity dashboards in Splunk Enterprise Security aggregate authentication and access events per identity, drawing on data models such as Authentication. This surfaces recent logins, source IPs and failed attempts for the compromised account, directly satisfying the requirement to review that user's login history.

Reducing the cron schedule directly lowers how often the correlation search executes, cutting cumulative CPU and memory consumption across the search head. Since resource exhaustion stems from repeated concurrent execution, widening the interval between runs satisfies the stem's constraint without altering detection logic or throttling individual alerts.

UBA is designed to learn normal behavior for users and peer groups, then flag deviations. Logins from two distant locations within minutes violate a learned travel-time baseline, so UBA surfaces this as an anomaly. This directly matches the scenario's need to compare current activity against a learned baseline.

'Status' tracks each notable event through the investigation workflow stages configured in Enterprise Security, such as New, In Progress, and Resolved. This satisfies the stem's requirement by representing workflow progression rather than severity, urgency, or owner assignment, letting analysts filter the Incident Review dashboard by investigation stage.

The timechart command aggregates events into time buckets and plots them as a time-series chart, with the split-by clause producing one series per sourcetype. This directly produces the visualisation requested, unlike stats or table which return tabular output.

This search sorts events by user and time, then uses streamstats to capture the previous event's time for each user, which corresponds to the login time when the current event is a logout. Filtering for logout events and calculating the difference yields the session duration efficiently.

A Risk Object normalises alerts from different correlation searches onto one entity, such as a user or host, so Splunk ES aggregates their risk scores. This lets analysts see cumulative risk per entity rather than isolated alerts, which is the framework's core purpose.

Throttling or exception logic prevents a risk rule from repeatedly contributing risk for the same entity in a short period. This directly addresses the repeated firing on benign activity for this user while keeping the rule active for other entities. It is the targeted approach that reduces score inflation without disabling detection.

GOVERN is the function added in NIST CSF 2.0 that houses organizational risk-management strategy, policy, roles, responsibilities, and supply-chain risk. Establishing policies and defining roles before incidents occur is exactly this function's scope, so citing it answers the CISO's question about pre-incident governance activities accurately.

Correlation Search Suppression lets you define a suppression rule directly on the Risk Notable correlation search, filtering out low-fidelity risk events before they generate notables. Editing the search itself or downstream risk rules would not cleanly exclude those events at source.

The Threat Intelligence Framework ingests external threat feeds and matches indicators such as IP addresses against indexed events, letting you confirm whether the address appears in a TOR exit-node intelligence source. This directly satisfies the requirement to verify an external IP against known malicious TOR exit-node data.

Incident Review provides the triage workspace where analysts assign, comment on, and change the status of notable events, driving them through investigation to closure. That management of notable events is its primary function, distinct from rule authoring or risk scoring.

This search keys on the parent-child relationship, requiring the parent image to be cmd.exe and the child image to be a scripting engine such as PowerShell, WScript, CScript, or Mshta. That combination is a classic living-off-the-land pattern for scripted execution, so it directly surfaces the behavior described while keeping noise manageable through the constrained image list.