203 questions total · 3pages · All types, answers revealed
Which TWO commands require a grouping field to function correctly?
Groups events by a common field.
Why this answer
Stats and transaction require a grouping field.
Which THREE of the following are common indicators that a host has been infected with malware?
Common for C2 communication.
Why this answer
Malware often creates outbound connections, changes system files, and executes unauthorized processes.
In a threat hunting workflow, what is the primary purpose of a 'Lookback' period?
This accounts for the delay between compromise and discovery.
Why this answer
The lookback period ensures the hunter scans enough historical data to cover the likely dwell time of an attacker.
Which component in Splunk ES is used to manage the lifecycle of an incident, including status updates and assignments?
Case Management is specifically designed for incident lifecycle tracking.
Why this answer
Case Management provides the structure and tools for incident lifecycle management.
You are hunting for evidence of credential dumping. You have access to Sysmon logs. Which EventCode should be the primary focus for detecting memory access to lsass.exe?
Event ID 10 is specifically designed for process access monitoring.
Why this answer
Sysmon Event ID 10 captures ProcessAccess, which is the standard event logged when a process like a credential dumper accesses the memory of lsass.exe.
When onboarding a new firewall source, you notice that the data is not populating the 'Network Traffic' data model. What is the most efficient first step to troubleshoot the CIM mapping?
The CIM Validator is the standard tool for verifying mapping compliance.
Why this answer
Using the CIM Validator app or running a search with the 'datamodel' command allows you to verify if the fields match the CIM requirements.
How can you ensure that a search field is only treated as a number for calculation purposes?
Tonumber explicitly forces a numerical data type.
Why this answer
The 'tonumber' function in 'eval' converts a string to a number.
You want to visualize the geographic origin of incoming connection attempts to identify potentially malicious traffic. Which dashboard is most appropriate?
This dashboard displays traffic origins on a map, which is useful for threat hunting.
Why this answer
The 'Geographic Information' dashboard in Splunk ES maps IP addresses to geographic locations.
Which THREE of the following are valid uses of the 'eval' command?
Logic function.
Why this answer
Creating fields, string concatenation, and math operations are valid.
You are mapping incoming alerts to the MITRE ATT&CK framework within the Splunk Enterprise Security (ES) Incident Review dashboard. Which attribute mapping ensures that your TTP-based notable events correctly reflect the adversary behavior?
This is the standard field used to associate threat intel objects with MITRE ATT&CK techniques.
Why this answer
The MITRE ATT&CK mapping in ES relies on the 'mitre_attack_id' field within the threat intelligence framework to correlate events with the enterprise matrix.
Which data model does the Risk Analysis adaptive response action typically rely upon to enrich events?
The Risk data model is the primary model used to store and query risk-related events in Splunk ES.
Why this answer
While it can run on raw events, the Risk Analysis action is often used in correlation searches that monitor data models like 'Network Traffic' or 'Authentication'.
You want to calculate the standard deviation of 'response_time' per 'server'. Which command is correct?
Stdev is the standard function for deviation in stats.
Why this answer
The 'stdev' function is used within the stats command.
Which THREE diagnostic tools or logs are useful for troubleshooting a malfunctioning correlation search?
Checking the output of the notable index confirms event creation.
Why this answer
Scheduler logs, search job inspector, and the internal notable event index are all key to diagnosing search failures.
Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?
You provide a descriptive message for the risk event.
Why this answer
The action allows configuration of the risk object, score, and message.
Which Splunk ES dashboard allows you to view and manage active threat intelligence feeds?
This dashboard manages feed health and configuration.
Why this answer
The Threat Intelligence Manager is the interface for managing and monitoring external threat feeds.
You are troubleshooting an 'Adaptive Response' action that is failing to execute on a remote device. What should you check first?
Adaptive Response relies on correctly configured Add-ons and connectivity.
Why this answer
The Splunk Add-on for the device must be configured with correct credentials and network connectivity must be verified between the Splunk instance and the device.
Which TWO of the following are common types of social engineering?
A manipulative social engineering technique.
Why this answer
Phishing and pretexting are classic examples of social engineering techniques.
An attacker is using PowerShell to obfuscate their activities. Which data model is most appropriate for searching for encoded PowerShell commands?
The Endpoint data model logs process names and command-line arguments.
Why this answer
The Endpoint data model captures process command-line arguments where PowerShell activity resides.
You are performing a search and want to ensure the subsearch runs against a specific time range relative to the main search. Which command/option achieves this?
Actually, this is a standard pattern, but the question asks for the mechanism of relative time.
Why this answer
The 'earliest' and 'latest' arguments within a subsearch bracket control the time window.
Which THREE elements are essential for a well-defined risk-based alert?
The threshold determines when risk becomes a notable.
Why this answer
RBA requires identifying the risk object, assigning a score, and using a correlation search to monitor that risk.
You want to use the 'eval' command to create a new field 'is_critical' that is 'yes' if 'severity' is 'high' or 'critical', and 'no' otherwise. Which syntax is correct?
The IN operator and if function are the cleanest way to handle multiple matches.
Why this answer
The 'if' function combined with 'in' or 'OR' logic is required.
A correlation search is failing to generate risk events. You check the 'Search Activity' and see that the search is running but returning 0 results. What is the most likely cause?
The most common reason for 0 results is a mismatch between the search logic and the indexed data fields.
Why this answer
If the search returns no results, the logic inside the search is likely too restrictive, such as incorrect data model mapping or field names.
Which THREE of the following are common phases defined in the Cyber Kill Chain model?
This is a valid phase of the Kill Chain.
Why this answer
The Cyber Kill Chain consists of Reconnaissance, Weaponization, Delivery, Exploitation, Installation, C2, and Actions on Objectives.
When a notable event is generated, where does the 'Risk Score' value originate?
Risk factors are user-defined during search configuration.
Why this answer
The risk score is calculated based on the risk factor assigned to the alert in the correlation search configuration.
Which TWO of the following are ways to verify if a file hash is truly malicious within Splunk ES?
This provides a second opinion from trusted repositories.
Why this answer
Checking against threat intelligence and using online reputation services are standard methods.
During an investigation, you need to group related notables into a single investigation container. Which feature should you use?
Case Management allows analysts to create cases and add relevant notable events to them.
Why this answer
In Splunk ES, 'Cases' are the primary mechanism for grouping and managing related notable events during an investigation.
Which Splunk ES dashboard allows an analyst to see a summary of all active notable events currently requiring investigation?
Incident Review is the main dashboard for triaging and investigating notable events.
Why this answer
The Incident Review dashboard is the primary interface for SOC analysts to manage active notable events.
A phishing campaign is targeting your organization. Which Splunk ES module is best suited to track the delivery of the malicious email URLs?
Threat Intel provides the framework to match incoming traffic against known malicious phishing URLs.
Why this answer
Threat Intelligence provides the infrastructure to ingest and correlate malicious URLs from phishing campaigns.
Which TWO of the following are examples of reconnaissance techniques used by attackers?
Collecting information about a target's infrastructure.
Why this answer
Port scanning and domain footprinting are common reconnaissance activities.
You need to ensure that the 'Threat Intelligence' framework periodically updates. Where do you configure the update interval?
The manager handles individual feed update schedules.
Why this answer
The Threat Intelligence Manager allows you to define the update interval for individual threat feeds.
Which THREE techniques can be used in Splunk to reduce the noise of false positives during a threat hunt?
Explicit exclusion is a common method for cleaning results.
Why this answer
Filtering known-good values, using lookup tables for exclusions, and weighting alerts are all standard methods for noise reduction.
You are conducting a hunt for unauthorized remote access tools. Which Splunk command is most effective for identifying processes that are running from unusual directories (e.g., AppData, Temp)?
This effectively filters for processes running from the AppData directory.
Why this answer
Filtering by 'Image' and using 'where' to identify paths containing 'AppData' or 'Temp' is a standard way to find suspicious persistence.
Which THREE of the following are valid search operators?
Union.
Why this answer
AND, OR, and NOT are the three fundamental boolean operators in SPL.
Which TWO ways can you enrich events with threat intelligence in Splunk ES?
Custom lookups are a standard way to join threat intel data.
Why this answer
Threat intel can be added via the 'Threat Intelligence' framework (using KV Store lookups) or by using standard 'lookup' commands against threat feeds.
You are onboarding a new Windows Event Log source using the Splunk Universal Forwarder. To ensure the data conforms to the Splunk Common Information Model (CIM) for the Authentication data model, where should you primarily configure the sourcetype?
The Splunk Add-on for Microsoft Windows provides the correct sourcetypes and CIM mapping configuration out of the box.
Why this answer
To ensure CIM compliance, data should be mapped to the appropriate CIM tags and fields. Configuring the sourcetype correctly in props.conf and transforms.conf (or via the Add-on Builder) ensures the data is parsed and tagged into the Authentication data model correctly.
Which search command is used to join threat intelligence data with your local search results?
'lookup' is the preferred method for enriching events with threat intel.
Why this answer
The 'lookup' command is the standard way to join event data with external or KV store-based threat intelligence.
Which TWO of the following are valid methods to mitigate an insider threat within Splunk ES?
RBA helps track user behavior over time.
Why this answer
Implementing RBA and using correlation searches are effective ways to proactively detect and block insider threats.
Which THREE of the following represent valid ways to use the 'lookup' command?
Standard lookup usage.
Why this answer
Standard lookup, lookup with OUTPUT, and lookup with AS aliasing are valid.
Which Splunk feature allows an analyst to save a specific search query, parameterize it with variables, and reuse it across different time ranges and entities?
Macros allow for reusable, parameterizable SPL blocks.
Why this answer
Splunk 'Reports' allow for saved searches, but 'Lookup Definitions' or 'Macros' are used for reusability. Macros are the standard way to parameterize queries.
When calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?
The 'sum' aggregation logic aggregates individual event scores into a total score.
Why this answer
The 'sum' aggregation method cumulatively adds the risk score of every incident to the total score of the object.
You notice a high volume of traffic from an internal workstation to a non-standard port on an external server. Which search helps identify the frequency of this connection?
tstats is the most efficient way to query indexed data models for volume analysis.
Why this answer
Using 'tstats' on the Network Traffic data model with 'count' grouped by time is the most efficient way to detect volume anomalies.
You are investigating a potential web-based attack. Which data model contains information regarding HTTP user-agents and request methods?
The Web data model is specific for HTTP/HTTPS metadata.
Why this answer
The 'Web' data model captures detailed information about web server traffic, including user-agents.
When using the Splunk Enterprise Security 'Threat Intelligence' framework, which file type is used to import custom STIX/TAXII threat feeds to align with the MITRE ATT&CK framework?
Threat intel management in ES relies on KV Store collections to store and map indicators.
Why this answer
The Threat Intelligence framework in ES supports importing custom feeds via CSV or KV Store lookups formatted as threat intel objects, often mapped to MITRE via STIX/TAXII integrations.
You are investigating a potential data exfiltration event. You have a lookup file called 'authorized_servers.csv' containing a field 'ip_address'. You want to find all connections to IPs not in this list. Which command fulfills this?
Using a lookup to output a field and checking for nulls is a standard way to find non-matches.
Why this answer
The 'inputlookup' combined with 'NOT [search]' or the 'lookup' command with a filter is used for exclusion.
You are investigating a suspicious PowerShell script. You suspect the script is using Base64 encoding. Which SPL function can you use to decode the string within Splunk?
This is the correct syntax for decoding Base64 strings.
Why this answer
The 'base64_decode' function in SPL is designed to handle this specific transformation.
What is the primary function of the 'Notable Event Suppression' feature?
The goal is to focus analysts on high-value alerts.
Why this answer
It allows users to prevent known false positives from creating notable events, reducing alert fatigue.
You are reviewing a Splunk Enterprise Security alert mapped to the MITRE ATT&CK technique 'T1059.001 (PowerShell)'. Which search command would best identify the use of obfuscated PowerShell commands?
This is the most efficient way to query endpoint process data for specific commands.
Why this answer
The 'tstats' command is the standard way to query data models efficiently, such as the 'Endpoint' model, to look for malicious PowerShell patterns.
What is the benefit of using the Asset and Identity framework in Splunk ES investigations?
Contextual enrichment makes events more actionable.
Why this answer
It provides contextual information (like user departments or host ownership) to notable events, allowing for better prioritization and investigation.
In Splunk ES, where can you manage the 'Risk Threshold' for triggering a Notable Event based on aggregate risk scores?
Risk Analysis configuration is where the risk score threshold for generating notable events is defined.
Why this answer
The Risk Notable Event threshold is configured within the Risk Analysis settings of the Splunk ES configuration menu.
You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?
This efficiently isolates process lineage to spot anomalous spawns from wmiprvse.exe.
Why this answer
Identifying abnormal parent-child relationships is a core hunting technique. Using tstats to aggregate process parent-child pairs is efficient.
Which component in the Splunk ES architecture is responsible for mapping disparate log sources to a unified schema?
The CIM Add-on provides the knowledge objects and schemas to normalize data.
Why this answer
The Splunk Common Information Model (CIM) is the framework that provides the schema for normalizing data across various sources.
Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?
This is a core NIST CSF function.
Why this answer
The five core functions of NIST CSF are Identify, Protect, Detect, Respond, and Recover.
You notice that the risk score for an asset is not decaying. Which configuration controls the risk score lifespan?
ES settings contain the global configuration for risk scoring and decay.
Why this answer
The 'Risk Analysis' settings in the ES app configuration dictate how long risk scores persist before decaying.
You are analyzing a data model using tstats. You need to identify rare process executions across your environment. Which command structure provides the most performance-optimized result?
This is the most efficient method using pre-calculated data models.
Why this answer
Using tstats with the 'summariesonly=true' parameter leverages accelerated data models, providing significantly faster results for large datasets.
You are troubleshooting a scenario where the 'Risk Notable' is not firing as expected. Which log file should you inspect first to confirm if the Risk Analysis action was successfully triggered?
splunkd.log contains logs for adaptive response executions and scheduling errors.
Why this answer
The splunkd.log file contains internal diagnostic information about adaptive response actions executed by the correlation search scheduler.
A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?
This dashboard specifically aggregates authentication data to highlight brute-force patterns.
Why this answer
The Access Anomalies dashboard provides a centralized view of authentication-related anomalies.
When troubleshooting a missing notable event, which search should you run to verify if the correlation search is producing results?
Testing the query logic directly confirms if events exist.
Why this answer
Running the search query defined in the correlation search manually allows you to see if the search logic is returning any results.
Which component of the Splunk Enterprise Security architecture is responsible for generating notable events?
The search head runs the scheduler that triggers notable events.
Why this answer
The 'Correlation Search' scheduler is the specific component that runs searches and triggers notable events.
You need to calculate the average time delta between 'login' and 'logout' events for each user. Which command approach is most effective?
The transaction command automatically calculates a 'duration' field for grouped events.
Why this answer
Transaction is effective for grouping events by a common ID and calculating duration.
Which TWO actions can be taken on a notable event directly from the Incident Review dashboard?
Updating the status is a key part of incident lifecycle management.
Why this answer
Analysts can run adaptive response actions and manage the notable event status directly from this dashboard.
If an analyst wants to see all risk events associated with a specific IP address, which search command is most effective?
tstats is the recommended approach for searching indexed data models.
Why this answer
The 'tstats' command is the most efficient way to query the risk data model for events associated with a specific field value.
You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?
This framework manages the output of detected threats.
Why this answer
The 'Notable Events' framework and 'Correlation Searches' are the primary mechanisms in ES for detecting and surfacing security anomalies.
You are configuring a new Data Model for use with Splunk Enterprise Security. Which action is required to ensure the data model accelerates correctly for use in notable event generation?
Enabling acceleration creates the summary files necessary for fast reporting and correlation searches.
Why this answer
Acceleration must be enabled and the summary range must be set to cover the retention period required for security investigations.
A malware infection is suspected on a host. You notice traffic on port 445. Which Splunk ES correlation search should be prioritized to investigate lateral movement?
This correlation search monitors for suspicious traffic patterns associated with internal movement.
Why this answer
Lateral movement typically involves SMB (port 445) traffic, which is tracked by the 'Lateral Movement' correlation search.
In the context of Splunk ES, what is an 'Asset'?
Assets are entities identified within the environment for risk context.
Why this answer
An asset represents an entity in the environment, such as a host or server, which is stored in the asset and identity framework for context enrichment.
Which TWO of the following are valid methods for enriching notable events in Splunk ES?
This framework is the standard ES method for adding context to notable events.
Why this answer
Lookups and Asset/Identity correlation are the primary methods for enriching events with context such as user roles or asset criticality.
Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?
Port scanning is a common reconnaissance technique.
Why this answer
Reconnaissance involves active or passive research performed by an attacker to gather information on a target's infrastructure.
Which TWO methods can be used to suppress notable events?
This is the underlying method for managing suppressions.
Why this answer
Suppression can be done via the UI (Incident Review) or by creating entries in the Notable Event Suppression lookup.
Which THREE of the following fields are required for mapping data to the 'Authentication' CIM data model?
Essential to identify the success or failure.
Why this answer
The Authentication data model requires the user, the status (success/failure), and the action taken.
An analyst is investigating an incident where a user's risk score spiked significantly. Which investigative tool allows the analyst to see the timeline of all contributing risk events?
This dashboard provides a dedicated view for analyzing risk event timelines for specific entities.
Why this answer
The 'Risk Analysis' dashboard displays a timeline and list of events that contributed to an object's current risk score.
An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?
These are the primary sources for detecting the delivery of malicious content.
Why this answer
The Delivery phase involves getting the malicious payload to the target, typically via email, web, or file transfer.
Which TWO areas of the Splunk ES environment are used to manage risk-based alerting configurations?
This is where global risk scoring and decay settings are defined.
Why this answer
The Correlation Search Editor and the Risk Analysis settings are the core locations for managing RBA.
You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?
This app provides the logic to compare incoming configuration data against known CIS standards.
Why this answer
To report on CIS benchmarks, you need to collect the configuration data and have a mechanism to compare it against the expected state (the benchmark).
When investigating a case, where should an analyst document their findings to ensure they are available to other team members?
The Comments section is designed for team collaboration and case logging.
Why this answer
Case Management supports adding comments or notes to a case to facilitate collaboration.
You want to suppress a specific correlation search alert for a legitimate vulnerability scan. What is the most precise way to achieve this without disabling the search?
Suppression entries allow for granular filtering of notable events.
Why this answer
Notable Event Suppression allows you to define specific filter criteria based on fields like host, user, or signature to ignore known false positives.
Practice SPLK-5001 by domain
Target a specific domain to shore up weak areas.