scenario questions

Which TWO of the following are key components of a successful incident investigation workflow in Splunk ES?

A security analyst is investigating a notable in Splunk ES and needs to determine the potential impact of the threat. The analyst wants to correlate the risk object with asset and identity data to understand the criticality of the affected system and the user's role. Which two actions should the analyst take to enrich the investigation with asset and identity context? (Choose two.)

A threat hunter wants to enrich firewall events with asset ownership data stored in a CSV lookup named asset_owners.csv, which maps dest_ip to owner and department. The lookup is already defined in transforms.conf. The hunter needs the owner and department fields added to each event. Which SPL search accomplishes this?

Which THREE tasks are performed within the 'CIM Setup' interface?

What is the purpose of the 'head' command?

An attacker is using a technique that involves 'living off the land' by utilizing legitimate system tools. Which data model is most effective to monitor these tools?

You are hunting for evidence that an adversary is using scheduled tasks to maintain persistence on Windows endpoints. Which TWO data sources or artifacts should you prioritize reviewing in Splunk for this hunt? (Choose two.)

An analyst in Splunk Enterprise Security is investigating a suspected Kerberoasting attack. They notice multiple Event Code 4769 events where the ticket encryption type is 0x17 and the service name is not a known service account. Which Splunk search would best identify the affected user accounts and the targeted service principal names (SPNs)?

You are a Splunk ES analyst investigating a notable event for an unusual login from a foreign IP. You need to determine the full context of the user's activity around that time, including all related authentication and VPN events. Which feature in Splunk Enterprise Security provides this consolidated view directly from the Incident Review dashboard?

During a proactive hunt for Kerberoasting in an Active Directory environment, you ingest Windows Security Event Code 4769 with the service ticket options field available as Ticket_Options. You want to isolate requests made with weak RC4 encryption rather than AES. Which Splunk search best surfaces these potentially malicious service ticket requests?

When drafting a threat hunting playbook, which of the following sections is most critical for ensuring the hunt is repeatable and auditable by other analysts?

A security analyst needs to create a search that identifies users who have logged in from more than three distinct countries within the last 24 hours, which could indicate compromised credentials. The authentication logs contain 'user' and 'src_country' fields. Which SPL search correctly identifies these users?

An analyst in Splunk Enterprise Security is investigating a potential DNS tunneling attack. They need to identify hosts that are sending an unusually high number of DNS queries to a single external domain within a short time window. Which search provides the most direct evidence of this behavior?

You are hunting for evidence of pass-the-hash lateral movement in your environment. Which Windows Security event and field combination is most indicative of this technique?

A security engineer is configuring a new correlation search that needs to correlate data across two different indexes. Which Splunk ES feature allows for efficient correlation across large datasets?

Which TWO of the following commands are used for data transformation or enrichment?

A defense analyst wants to correlate proxy logs and firewall logs to find internal hosts that contacted a known-malicious domain. The proxy logs store the field dest_host and the firewall logs store the field fqdn, and both indexes contain a common field src_ip. The analyst wants a single result set showing src_ip values present in both data sources for the same domain. Which SPL approach returns only hosts seen in both logs for matching domains?

A security analyst wants to extract the domain from a URL field in proxy logs to identify the most frequently accessed domains. The URL field contains values like 'https://www.example.com/path/page.html'. Which SPL command and function should the analyst use to extract just the domain?

A SOC analyst is reviewing a notables list in Splunk Enterprise Security and wants to see the individual risk events that contributed to a specific notable's risk score. The analyst opens the notable's detail view and looks for a way to pivot directly to the contributing risk events. Which action should the analyst take?

Which phase of the proactive threat hunting methodology involves identifying the specific threat actor or technique to be investigated?

A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?

A security analyst needs to quickly identify all notable events that are assigned to them and are still open. Which Splunk ES dashboard provides this information with the ability to filter by owner and status?

A user reports that a specific dashboard panel is timing out. After checking the search job, you notice it is scanning too much data. Which configuration should you adjust?

A Splunk ES analyst receives a notable event indicating that a user account has been locked out due to multiple failed login attempts. The analyst wants to determine if this is a brute force attack or a user error. Which data model should the analyst examine to review the authentication activity for that user?

When configuring an 'Adaptive Response' action, what does the 'Notable' action type do?

An analyst is triaging a suspected brute-force attack and needs to view raw event text alongside a computed field showing how many seconds elapsed between consecutive failed logins from the same source IP. The events must remain individually visible, in time order, with the delta shown per event. Which SPL search best meets this need?

Which Splunk Enterprise Security feature allows you to manage the lifecycle of a notable event?

An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?

You are hunting for living-off-the-land binary (LOLBin) abuse on Windows endpoints. You have Sysmon EventCode 1 process creation logs. Which search best surfaces suspicious use of a signed Microsoft binary to download or execute remote content?

You are using a subsearch to find 'dest_ip' values that appeared in a 'failed_login' search. What is a common limitation of subsearches that you must consider?

A SOC manager wants to review the overall risk posture of the organization by examining the highest-risk users and systems over the past week. Which Splunk Enterprise Security dashboard provides this aggregated view of risk objects and their scores?

Which THREE pieces of information are commonly found in a Splunk ES Case?

A SOC manager is aligning Splunk Enterprise Security with the NIST Cybersecurity Framework. They need to ensure that the 'Respond' function is properly supported. Which Splunk ES feature is specifically designed to facilitate the 'Respond' function by automating actions such as blocking IPs or disabling users?

A security analyst is mapping Splunk ES correlation searches to the MITRE ATT&CK framework. The analyst needs to identify the technique that describes adversaries using legitimate credentials to access accounts, which often enables lateral movement and evasion. Which MITRE ATT&CK technique should the analyst map to?

A Splunk ES analyst notices a spike in `Endpoint` data model events where `process_name` is `powershell.exe` with a command line containing `-EncodedCommand` and `DownloadString`, spawning from `winword.exe` on several finance workstations. Which MITRE ATT&CK technique does this activity most directly map to?

Which TWO factors influence an object's final risk score in Splunk ES?

An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?

A security analyst is configuring a new correlation search in Splunk Enterprise Security to detect brute-force attacks. The analyst wants to ensure that the notable events generated by this search are properly categorized and can be easily tracked. Which two actions should the analyst perform when creating the correlation search? (Choose two.)

Which THREE components are required for an Adaptive Response action to function?

You are creating a custom Adaptive Response action. The action requires a Python script. Where must this script be placed for the Splunk instance to execute it?

You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?

When designing a threat hunting playbook, which TWO components must be included to ensure the hunt is actionable?

An analyst is investigating a suspected DNS tunneling attack. They need to identify hosts that are generating an unusually high number of DNS queries with long, random-looking subdomains. Which Splunk search is most effective for this detection?

You are hunting for evidence of data exfiltration over HTTP. You have web proxy logs ingested into Splunk and want to identify internal hosts that have uploaded an unusually large amount of data to external sites in the past week. Which field in the proxy logs is most relevant for measuring outbound data volume?

A SOC analyst is reviewing an investigation in Splunk Enterprise Security and wants to determine whether a specific threat intelligence indicator has been observed in the environment over the past 90 days. Which investigation technique best supports this requirement?

A Splunk ES analyst is configuring the Threat Intelligence Framework to ingest a STIX/TAXII feed. They need to ensure that the indicators are properly parsed and available for correlation. Which file type must be used to define the threat intelligence source?

You are investigating a user who has triggered multiple high-risk alerts. Where in Splunk ES can you view the historical risk score progression for this specific user?

Which THREE actions are part of the 'Incident Review' investigation workflow?

Which THREE of the following data sources are most valuable for detecting an insider threat?

What is the effect of changing the 'Retention Period' in the Enterprise Security app settings?

An analyst is reviewing a notables queue in Splunk Enterprise Security and wants to understand why a particular correlation search generated a high-severity finding. The analyst opens the finding in Incident Review and notices the severity is set to 'high', but the contributing risk score is only 40. Which component of the correlation search configuration most directly determines the severity displayed on the finding?

You are hunting for anomalous PowerShell activity. Which THREE indicators or behaviors should you look for in your Splunk data?

An attacker uses a weaponized document that exploits a vulnerability to execute code without writing a file to disk. Which detection approach in Splunk ES is best suited to identify this fileless attack?

When reviewing an incident, how can an analyst verify if the notable event was generated by a specific correlation search?

A security team is aligning their Splunk ES deployment with the NIST Cybersecurity Framework (CSF) 'Respond' function. They want to ensure that their incident response capabilities are properly supported by Splunk ES features. Which TWO of the following Splunk ES features are most directly aligned with the 'Respond' function? (Choose two.)

You have a field 'raw_data' containing JSON. How do you extract fields from it within your SPL search?

What is the purpose of the 'map' command in complex searches?

What is the purpose of the 'Investigation Workbench' in Splunk ES?

When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?

A security team is using Splunk Enterprise Security to monitor for suspicious activity. They want to create a correlation search that triggers a notable event when a user's risk score exceeds a certain threshold. Which Splunk ES feature should they use to automatically adjust risk scores based on events?

What is the purpose of the 'Assets and Identities' framework in Splunk ES?

Which THREE of the following represent the categories of threat intelligence that can be managed within the Splunk Enterprise Security 'Threat Intelligence' framework?

A user account is exhibiting signs of being compromised. Where can you find the user's recent login history in Splunk ES?

Which TWO actions should be taken if a correlation search is consuming too many system resources?

A SOC analyst receives an alert that a user's credentials were used from two geographically distant locations within five minutes. Which Splunk ES capability is designed to surface this type of anomaly by comparing current activity to a learned baseline?

In the Incident Review dashboard, what does 'Status' represent?

Which command is used to visualize data in a time-series chart?

A security analyst wants to correlate login and logout events for each user to calculate session durations. The events have fields 'user', 'action' (login or logout), and '_time'. Which SPL command sequence is most efficient to pair each login with the subsequent logout for the same user?

When using the 'Risk Analysis' framework in Splunk ES, what is the primary benefit of assigning a 'Risk Object'?

During an investigation, an analyst determines that a user's risk score is inflated because a single risk rule is firing repeatedly on benign activity. The analyst wants to reduce the impact of this rule on the user's overall risk score without disabling the rule entirely. What is the most appropriate action?

A healthcare SOC is preparing an executive briefing that maps its Splunk Enterprise Security detections to the NIST Cybersecurity Framework 2.0. The CISO specifically asks which function covers activities such as establishing policies, defining roles, and performing risk assessments before any incident occurs. Which NIST CSF 2.0 function should the analyst cite for these governance and risk-management activities?

A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?

You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?

What is the primary function of the 'Incident Review' dashboard in Splunk ES?

An analyst is hunting for evidence that an adversary used the Windows command shell to spawn a script interpreter in a suspicious parent-child relationship. The endpoint telemetry is in Splunk via Sysmon EventCode 1. Which search most directly surfaces processes whose parent is cmd.exe and whose image is a scripting engine?

When utilizing the Splunk Common Information Model (CIM), which field name is standard for identifying the destination IP address across different data sources?

A security analyst is building a search to identify brute force attacks. They want to use the 'stats' command to calculate the count of failed login attempts per source IP, and then filter for IPs with more than 10 failures. They also want to include the earliest and latest timestamps of these failures. Which two SPL commands or functions should be used to achieve this? (Choose two.)

You are hunting for Kerberoasting activity in your Windows environment. You have Splunk ingesting Windows Security event logs. Which Event ID and field combination best supports identifying accounts requesting service tickets with weak encryption?

You want to dynamically update a lookup table with new indicators of compromise (IOCs) found during your search. Which command is used for this?

An analyst is investigating a suspected DNS tunneling attack. Which Splunk ES data model and field should be used to identify hosts making an unusually high number of unique DNS queries with long subdomain strings?

You notice a system process attempting to connect to a suspicious external domain. Which CIM data model would contain this network connection information?

What is the result of using 'bin _time span=1d'?

Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?

Which TWO actions should be performed during the 'Data Preparation' phase of a threat hunt to ensure accurate results?

Which TWO metrics are tracked in the 'Incident Review' dashboard's 'Notable Event' list?

An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?

Which THREE features are provided by the Splunk ES Incident Review dashboard?

A security engineer is configuring a correlation search that should only trigger a notable event if the source IP is not in a list of known internal IP addresses. The list is maintained in a CSV file on the Splunk search head. Which Splunk ES feature should the engineer use to reference this list within the correlation search?

A security analyst is configuring a new data model in Splunk Enterprise Security to accelerate a correlation search. After creating the data model, the analyst notices that the correlation search is still not performing efficiently. What is the most likely reason for the poor performance?

Which THREE things are required for Splunk Enterprise Security to provide meaningful security insights?

A Splunk ES analyst receives a notable event for 'Excessive Failed Logins' on a Windows server. The analyst wants to determine if this is a brute-force attack or a misconfigured service account. Which field in the notable event would best help differentiate between these two scenarios?

If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?

Where do you go in Splunk ES to adjust the sensitivity (risk score) of a specific correlation search?

You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?

A risk analyst notices that a user account accumulated a high risk score from multiple contributing risk events, but the score does not reflect the expected sum of the individual risk rule weights. Which factor most likely explains the discrepancy?

You are using 'lookup' to add user info. What happens if the common field doesn't exist in the lookup file?

Which TWO methods can be used to suppress unwanted notable events?

Which TWO factors are critical for effective Asset and Identity enrichment?

An analyst is investigating a potential ransomware outbreak. They observe a high volume of file encryption activity and want to identify the initial infection vector. Which TWO of the following Splunk ES data models would be most useful to correlate endpoint and network activity to trace the source? (Choose two.)

You are configuring a 'Notable Event' to use a specific 'Drilldown' link. What syntax is used to pass fields from the event into the URL?

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

A security team is aligning its Splunk ES deployment with the NIST Cybersecurity Framework. The team wants to ensure that they can effectively respond to detected incidents by executing predefined procedures. Which NIST CSF function and category should they focus on to achieve this?

Which TWO factors directly impact the urgency of a notable event in Splunk ES?

Which THREE of the following are common indicators that a host has been infected with malware?

In a threat hunting workflow, what is the primary purpose of a 'Lookback' period?

Which component in Splunk ES is used to manage the lifecycle of an incident, including status updates and assignments?

A Splunk ES analyst receives a notable event for a possible phishing attack. The email contains a malicious link that, when clicked, downloads a payload. Which Splunk ES data model and field would best help the analyst quickly identify all users who clicked the link and the associated URLs?

You are hunting for evidence of credential dumping. You have access to Sysmon logs. Which EventCode should be the primary focus for detecting memory access to lsass.exe?

When onboarding a new firewall source, you notice that the data is not populating the 'Network Traffic' data model. What is the most efficient first step to troubleshoot the CIM mapping?

A security team is using Splunk Enterprise Security to monitor for malware infections. They want to ensure that the 'Malware' data model is populated with events from their endpoint protection logs. The endpoint logs are already being ingested and have the correct sourcetype. Which CIM data model should the team map these logs to?

You want to visualize the geographic origin of incoming connection attempts to identify potentially malicious traffic. Which dashboard is most appropriate?

Which THREE of the following are valid uses of the 'eval' command?

An analyst is investigating a potential data exfiltration incident and wants to determine the adversary's stage according to the Cyber Kill Chain. The analyst observes large outbound transfers to an unfamiliar external IP address after a period of internal reconnaissance. Which phase of the Cyber Kill Chain does this activity represent?

Which data model does the Risk Analysis adaptive response action typically rely upon to enrich events?

You want to calculate the standard deviation of 'response_time' per 'server'. Which command is correct?

Which THREE diagnostic tools or logs are useful for troubleshooting a malfunctioning correlation search?

Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?

Which Splunk ES dashboard allows you to view and manage active threat intelligence feeds?

An analyst is investigating a potential DLL sideloading attack on a Windows host. Which Splunk ES data model and field can be used to detect the loading of a malicious DLL from an unusual path?

A SOC manager is defining requirements for a new detection that should contribute to an entity's risk profile in Splunk Enterprise Security. Which TWO characteristics must the detection have to properly contribute risk to an entity? (Choose two.)

You are hunting for persistence via Windows scheduled tasks. You have Splunk ingesting Windows Event Logs and Sysmon. Which Event ID and field should you prioritize to detect a newly created scheduled task that runs a suspicious binary?

A security team is mapping its Splunk Enterprise Security (ES) detections to the MITRE ATT&CK framework. The team wants to identify all active detections that can detect adversary behavior related to credential dumping. Which Splunk ES feature should they use to view the MITRE ATT&CK techniques and the associated detections?

You are troubleshooting an 'Adaptive Response' action that is failing to execute on a remote device. What should you check first?

A security analyst has created a new correlation search that generates notable events. After the search runs, the analyst notices that the notable events are not appearing in the Incident Review dashboard. The search itself returns results when run manually. Which configuration should the analyst verify first?

An analyst is using Splunk Enterprise Security to investigate a potential data exfiltration incident. The analyst wants to determine the stage of the attack according to the Cyber Kill Chain. The analyst observes that a large volume of data is being transferred from an internal database server to an external IP address. Which phase of the Cyber Kill Chain does this activity represent?

A Splunk ES analyst is investigating an incident and needs to determine the potential impact of a compromised user account. The analyst wants to see all assets and identities associated with the user, including their roles and privileges, to assess lateral movement risks. Which Splunk ES feature should the analyst use?

A retail company's SOC uses Splunk Enterprise Security to enrich alerts with threat intelligence. The intelligence lead wants to categorize feeds so analysts know whether an indicator is a raw observable, contextual reporting about an actor, or a confirmed malicious indicator. Which model should the analyst use to classify these feeds as strategic, operational, tactical, or technical intelligence?

An analyst is investigating a notable event in Splunk ES and needs to determine which correlation search generated it and what risk objects contributed to its creation. Which Splunk ES feature provides this information directly from the notable event?

Which TWO of the following are common types of social engineering?

While hunting for Kerberos-based attacks, you notice a service account requesting service tickets for many distinct SPNs across multiple servers within a short window. You want to correlate this with the account's normal baseline to confirm abnormal breadth. Which approach most directly supports that analysis in Splunk?

A risk analyst notices that a particular risk rule is generating an excessive number of risk events for low-severity activities, causing alert fatigue. The analyst wants to reduce the impact of this rule on overall risk scores without disabling it entirely. What is the most appropriate action?

An attacker is using PowerShell to obfuscate their activities. Which data model is most appropriate for searching for encoded PowerShell commands?

A correlation search is failing to generate risk events. You check the 'Search Activity' and see that the search is running but returning 0 results. What is the most likely cause?

Which THREE of the following are common phases defined in the Cyber Kill Chain model?

A SOC manager is defining a new risk-based alerting (RBA) strategy in Splunk Enterprise Security. The manager wants to ensure that risk events are properly attributed to the correct entities so that risk scores aggregate accurately. Which two actions should the manager take when configuring risk rules? (Choose two.)

An analyst notices that several Windows workstations are repeatedly resolving domain names such as 'update.microsoft.com.security-check.net' and 'login.office365.com.auth-verify.org'. These lookups occur shortly before outbound HTTPS connections to the resolved IPs. Which type of attack technique is most consistent with this observation?

When a notable event is generated, where does the 'Risk Score' value originate?

Which TWO of the following are ways to verify if a file hash is truly malicious within Splunk ES?

A Splunk Enterprise Security analyst is briefing new SOC hires on how the MITRE ATT&CK framework differs from the Cyber Kill Chain when mapping detections. The analyst wants to highlight characteristics that are true of ATT&CK but not of the linear Cyber Kill Chain. (Choose two.)

During an investigation, you need to group related notables into a single investigation container. Which feature should you use?

Which Splunk ES dashboard allows an analyst to see a summary of all active notable events currently requiring investigation?

A security analyst is reviewing the Cyber Kill Chain phases and wants to map Splunk ES detections to the 'Weaponization' phase. Which activity would be most indicative of this phase?

Which TWO of the following are examples of reconnaissance techniques used by attackers?

A security analyst wants to identify which users have logged in from more than one distinct country in the last 24 hours, a possible sign of credential compromise. The events contain user and src_country fields. Which SPL search best identifies these users?

A security team is mapping their Splunk Enterprise Security detections to the MITRE ATT&CK framework. They want to identify techniques that adversaries use to maintain persistent access on compromised endpoints. Which MITRE ATT&CK tactic should they focus on first?

Which THREE techniques can be used in Splunk to reduce the noise of false positives during a threat hunt?

Which THREE of the following are valid search operators?

Which TWO ways can you enrich events with threat intelligence in Splunk ES?

A security analyst is investigating a potential data exfiltration event. They need to calculate the rate of outbound data transfer per source IP over the last 30 minutes, but the raw logs only contain cumulative byte counts per connection. Which SPL command sequence correctly computes the per-second rate of change for each src_ip?

A security team at a financial institution is aligning its detection capabilities with the MITRE ATT&CK framework. They want to identify techniques related to the 'Credential Access' tactic. Which TWO of the following are MITRE ATT&CK techniques that belong to the Credential Access tactic? (Choose two.)

You are conducting a threat hunt for data exfiltration over DNS. Which TWO Splunk search techniques are most effective for identifying anomalous DNS tunneling activity in your DNS logs? (Choose two.)

You are onboarding a new Windows Event Log source using the Splunk Universal Forwarder. To ensure the data conforms to the Splunk Common Information Model (CIM) for the Authentication data model, where should you primarily configure the sourcetype?

Which search command is used to join threat intelligence data with your local search results?

Which TWO of the following are valid methods to mitigate an insider threat within Splunk ES?

A security analyst needs to create a correlation search that detects when a user account is locked out and then successfully logs in within 10 minutes. The analyst wants to ensure that the search does not generate duplicate notable events for the same user within a 24-hour period. Which Splunk Enterprise Security feature should the analyst use to achieve this?

Which THREE of the following represent valid ways to use the 'lookup' command?

Which Splunk feature allows an analyst to save a specific search query, parameterize it with variables, and reuse it across different time ranges and entities?

You are hunting for DNS-based data exfiltration using Splunk, where malware encodes stolen data in subdomain labels of queries to an attacker-controlled domain. Which two search constructs most directly help you quantify abnormally long or high-entropy query names and identify the destination domain being abused? (Choose two.)

A SOC manager is defining a new risk-based alerting strategy and wants to ensure that risk events generated by correlation searches are properly attributed and actionable. Which TWO fields are required in a risk event for the Risk Analysis framework to correctly associate risk with an entity and contribute to its score? (Choose two.)

When calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?

An analyst notices a Splunk ES notable event indicating a possible DNS exfiltration. In the Network_Traffic data model, which field contains the domain name being queried by an internal host?

A security operations center (SOC) is using Splunk Enterprise Security to align with the MITRE ATT&CK framework. The team wants to improve detection of techniques within the 'Credential Access' tactic. Which TWO of the following data sources are most critical to enable for detecting credential dumping techniques such as LSASS memory access? (Choose two.)

You are investigating a potential web-based attack. Which data model contains information regarding HTTP user-agents and request methods?

You are preparing a hunt for suspicious PowerShell execution and want to search only the accelerated data model rather than raw events to return results faster across a large environment. Which Splunk construct should you use?

A SOC manager wants to measure the effectiveness of detection coverage against the MITRE ATT&CK framework using Splunk Enterprise Security. The manager needs to visualize which tactics have the most and least coverage based on enabled correlation searches. Which Splunk ES feature should be used to generate this coverage map?

You are investigating a suspicious PowerShell script. You suspect the script is using Base64 encoding. Which SPL function can you use to decode the string within Splunk?

What is the primary function of the 'Notable Event Suppression' feature?

An analyst is reviewing Splunk Enterprise Security correlation search results and notices a notable event for a host named WEB-01 indicating a possible web shell. The analyst wants to quickly identify the exact command and URI used in the initial exploit. Which Splunk ES data model should the analyst examine to find the HTTP request method and URI associated with this event?

What is the benefit of using the Asset and Identity framework in Splunk ES investigations?

A security analyst receives an alert about a possible DNS tunneling attack. They need to examine DNS query logs to identify unusually long domain names that might indicate data exfiltration. Which Splunk ES data model should they use?

A SOC analyst is reviewing a notable event for a suspected compromised host. The analyst wants to enrich the investigation by viewing the raw event that triggered the detection, along with the associated risk events and threat intelligence matches, directly from the notable event in Splunk Enterprise Security. Which feature should the analyst use to access this consolidated context?

You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?

Which component in the Splunk ES architecture is responsible for mapping disparate log sources to a unified schema?

Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?

You notice that the risk score for an asset is not decaying. Which configuration controls the risk score lifespan?

A security team wants to align their Splunk Enterprise Security (ES) deployment with the NIST Cybersecurity Framework (CSF) 2.0 to improve governance and risk management. They are specifically focused on the 'Identify' function. Which of the following activities best exemplifies the use of Splunk ES to support the 'Identify' function?

You are hunting for suspicious PowerShell activity on endpoints. You have PowerShell Script Block Logging (Event ID 4104) ingested into Splunk. Which search best identifies scripts that download and execute remote content, a common attacker technique?

During an investigation, an analyst observes multiple `Endpoint` events where `lsass.exe` is accessed with `PROCESS_VM_READ` by a non-standard binary named `diagtrack.exe` running from `C:\Users\Public\`. Which Splunk ES data model and field combination best supports detecting this credential-dumping behavior?

A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?

When troubleshooting a missing notable event, which search should you run to verify if the correlation search is producing results?

Which component of the Splunk Enterprise Security architecture is responsible for generating notable events?

A security analyst is reviewing an incident where an attacker used the technique 'T1071.001 - Application Layer Protocol: Web Protocols' for command and control. The analyst needs to identify which data sources in Splunk ES would be most effective for detecting this activity. Which of the following data sources should be prioritized?

Which TWO actions can be taken on a notable event directly from the Incident Review dashboard?

You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?

You are configuring a new Data Model for use with Splunk Enterprise Security. Which action is required to ensure the data model accelerates correctly for use in notable event generation?

A malware infection is suspected on a host. You notice traffic on port 445. Which Splunk ES correlation search should be prioritized to investigate lateral movement?

In the context of Splunk ES, what is an 'Asset'?

Which TWO of the following are valid methods for enriching notable events in Splunk ES?

Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?

An analyst observes a series of events where a process creates a child process with a command line that includes encoded PowerShell commands. The parent process is a Microsoft Office application. Which attack technique is most likely being used?

A security analyst needs to quickly identify which users have logged in from more than three distinct source IP addresses in the last 24 hours. Which SPL command correctly calculates the number of distinct source IPs per user?

An analyst is investigating an incident where a user's risk score spiked significantly. Which investigative tool allows the analyst to see the timeline of all contributing risk events?

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

Which TWO areas of the Splunk ES environment are used to manage risk-based alerting configurations?

You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?

When investigating a case, where should an analyst document their findings to ensure they are available to other team members?

You want to suppress a specific correlation search alert for a legitimate vulnerability scan. What is the most precise way to achieve this without disabling the search?

You are reviewing the data ingestion pipeline for Splunk Enterprise Security. To ensure that the CIM (Common Information Model) is correctly applied to your data, which two actions are required when configuring a new data source? (Choose two.)

You need to modify the default 'Risk Score' logic for a specific asset. Where should this customization occur?

A Splunk ES analyst is investigating a potential Kerberoasting attack. The analyst wants to identify the key indicators of this activity. Which TWO of the following are primary indicators of a Kerberoasting attack that the analyst should look for in Splunk ES? (Choose two.)

Which THREE commands can be used to handle or create statistical summaries?

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

A SOC analyst is reviewing a notable event in Splunk Enterprise Security that was generated from a correlation search firing against a risk index. The analyst wants to see the individual risk events that contributed to the notable's risk score, including the contributing risk rules and their individual risk scores. Which action should the analyst take?

A Splunk ES analyst is tuning a correlation search that generates a large number of false positives. The analyst wants to reduce noise without disabling the search entirely. The search currently uses a risk rule that assigns a risk score of 20 to each matching event. Which approach best aligns with risk-based alerting best practices?

Which command is used to rename a field in the results table for better readability?

When configuring a correlation search, what does the 'Notable Event' field 'Urgency' determine?

You are troubleshooting why a specific Correlation Search is not appearing in the Incident Review dashboard despite the search returning results. What is the most likely cause?

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

A SOC manager is configuring a new correlation search in Splunk ES to detect potential data exfiltration. The search should trigger a notable event and also automatically create a ticket in the organization's ticketing system via a third-party API. Which two configurations are required to achieve this? (Choose two.)

A Splunk ES analyst is investigating a potential ransomware incident. Which TWO of the following are valid indicators of ransomware activity that should be prioritized for detection? (Choose two.)

A correlation search is failing to generate notable events due to a time-zone mismatch in the source data. What is the best way to handle this in Splunk?

An analyst is investigating a potential ransomware incident. They notice a high volume of file modifications with the .locky extension across multiple shared drives. Which Splunk ES data model is most appropriate to search for these file system changes?

A Splunk security analyst is mapping the organization's detection capabilities to the NIST Cybersecurity Framework (CSF) Core functions. The analyst wants to ensure that the team can effectively identify anomalous activity across the enterprise. Which CSF function should the analyst prioritize to meet this objective?

A user reports that their files have been encrypted and a ransom note is displayed on their screen. Which type of malware is most likely responsible?

A Splunk ES analyst is investigating a series of notable events indicating possible pass-the-hash attacks. The events show successful authentications using NTLM from unusual source workstations to multiple servers. Which data model should the analyst query to correlate the authentication events and identify the compromised user accounts?

A Splunk ES analyst is investigating a series of notable events related to a possible DNS tunneling attack. The analyst wants to identify domains that are being queried with unusually high frequency or with long subdomain strings, which are common indicators of DNS tunneling. Which Splunk ES data model should the analyst use to efficiently search for these DNS query patterns?

During an investigation of a suspected malware outbreak, an analyst needs to identify all internal hosts that have communicated with a known malicious IP address. Which Splunk ES data model should be used to search for this network communication?

Which of the following is a primary benefit of Risk-Based Alerting (RBA) over traditional alerting?

A security analyst needs to correlate two event types for the same user within a 10-minute window: a 'login' event and a subsequent 'privilege_escalation' event. The events share a common field 'user'. Which SPL command should be used to join these events based on the user and time proximity?

A Splunk ES analyst is reviewing an incident where an attacker used a compromised user account to move laterally within the network. The analyst wants to map this activity to the MITRE ATT&CK framework. Which tactic best describes the attacker's actions?

You are hunting for beaconing activity in proxy logs ingested into Splunk, where an implant contacts its command-and-control server at regular intervals with small jitter. Which analytic approach best identifies a host exhibiting this periodic communication pattern?

An attacker has gained access to a workstation and is attempting to move laterally within the network. Which TWO of the following techniques are commonly used for lateral movement that you should monitor in Splunk ES? (Choose two.)

What does the 'OR' operator do in a search?

A security analyst is new to Splunk Enterprise Security and needs to understand how data is normalized across different sources. They notice that events from different vendors have different field names for the same concept, such as 'user' versus 'username'. Which Splunk ES component is responsible for normalizing these fields to a common schema?

A junior analyst is asked to find all risk events associated with a specific user account to assess potential insider threat activity. Which search command should the analyst use to retrieve these risk events from the risk index?

A security analyst is reviewing the Incident Review dashboard in Splunk ES and wants to add a new field to the table that displays notable events. The field, 'src_ip', is already present in the notable event's raw data but not displayed. What should the analyst do to make this field visible in the Incident Review table?

A security analyst is writing SPL searches to detect suspicious activity and wants to understand which commands can be used to filter or transform search results. Which TWO of the following statements about SPL commands are accurate? (Choose two.)

An analyst needs to review firewall traffic but only for events where the action field is explicitly 'blocked' and the bytes_out field is greater than 5000. Some events are missing the action field entirely. Which SPL search returns only events that satisfy both conditions?

A security analyst notices that a correlation search configured to detect multiple failed logins across the organization is not triggering notable events, even though the raw events are searchable. The correlation search uses the Authentication data model. Upon investigation, the analyst finds that the Authentication data model is not accelerated. What is the most likely reason the correlation search is failing to generate notables?

Which THREE attributes are commonly used to filter notable events in the Incident Review dashboard?

You suspect an attacker is using 'living-off-the-land' (LotL) techniques. Which Sysmon event should you analyze to see command-line arguments of suspicious utilities?

Which TWO commands are helpful for identifying specific patterns in data?

An analyst is using Splunk Enterprise Security to investigate a potential data exfiltration event. They need to determine which MITRE ATT&CK tactic describes the adversary's objective of stealing data from the compromised network. Which tactic should they reference?

An analyst is investigating a potential pass-the-hash attack in Splunk ES. Which TWO of the following are indicators that should be reviewed in Windows Security event logs? (Choose two.)

An analyst is reviewing a notable event for a potential malware infection on a Windows endpoint. The event includes a file hash. To determine if the file is known malicious, the analyst wants to check its reputation using Splunk ES's threat intelligence framework. Which action should the analyst take?

Which THREE of the following are benefits of using Risk-Based Alerting (RBA) in Splunk ES?

An analyst is investigating a potential pass-the-hash attack. They want to search for successful authentications that used NTLM authentication where the source workstation differs from the destination workstation. Which Splunk ES data model and field combination is most appropriate?

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

Which THREE commands are used to manipulate multi-value fields?

Which THREE of the following are valid ways to filter events based on time?

You are tasked with reporting on 'Lateral Movement' (MITRE ATT&CK) using Splunk ES. Which Data Model must be populated and enabled for this report to function correctly?

Which dashboard provides a summary of all assets categorized by their criticality within the organization?

During an investigation, an analyst needs to correlate a series of authentication failures with subsequent successful logins from the same source across multiple indexers. Which Splunk Enterprise Security capability is most appropriate for this task?

A security analyst needs to identify all Windows event codes where the count of events exceeds 100 in the last 24 hours, and then display the results sorted by count in descending order. The base search returns events with the field 'EventCode'. Which SPL search accomplishes this?

An analyst is investigating a potential command-and-control (C2) beaconing incident. They observe periodic outbound connections from an internal host to an external IP address at regular intervals with small data transfers. Which two Splunk ES features or techniques would best help confirm and analyze this beaconing activity? (Choose two.)

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

During a proactive threat hunt, you want to quickly identify processes that were executed from a temporary directory such as C:\\Users\\Public on Windows endpoints, using Sysmon data. Which Splunk search is most appropriate to surface this activity?

A security analyst is reviewing the Cyber Kill Chain phases and wants to map Splunk ES detections to the "Command and Control" phase. Which of the following data sources would be most relevant for detecting command and control communications?

An analyst is investigating a suspected credential dumping attack on a Windows host. They want to identify evidence of this activity in Splunk ES. Which TWO of the following are valid indicators of credential dumping that can be found in Splunk ES data? (Choose two.)

When using 'stats', how can you include the values of a field as columns in your output?

Which TWO of the following are key components of the Splunk ES Threat Intelligence framework?

A security analyst is investigating a potential insider threat and needs to see the number of events per hour for a specific user over the past 48 hours. The events are in the 'index=insider' with a field 'user'. Which SPL search will produce a time chart showing hourly event counts for that user?

You are aligning your Splunk ES deployment with the NIST Cybersecurity Framework (CSF) to improve your organization's security posture. The CSF Core consists of five functions: Identify, Protect, Detect, Respond, and Recover. Which TWO of the following Splunk ES capabilities most directly support the 'Respond' function? (Choose two.)

A security analyst needs to identify the percentage of total authentication events that each user account generated over the past week. The search must return the user, the count of events for that user, and the percentage each user represents of all authentication events, sorted so the largest share appears first. Which SPL search accomplishes this?

You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?

An analyst identifies a command-and-control (C2) beaconing pattern. Which search command would be best used to identify the frequency of connections to a specific domain?

Which command is used to append results from one search to another?

A security analyst is documenting the key phases of a Splunk Enterprise Security investigation workflow for a new team member. Which two phases are essential components of this workflow? (Choose two.)

When configuring the 'Risk Analysis' adaptive response, what does the 'risk_score' parameter represent?

What is the primary function of the 'Risk Notable' correlation search in Splunk ES?

When dealing with multi-value fields, which command allows you to break them into individual events?

What is the purpose of the 'Incident Review' dashboard in Splunk ES?

An analyst is building a risk rule that assigns a risk score to a user based on the number of failed authentication attempts observed in a 10-minute window. The analyst wants the risk score to increase proportionally with the number of failures, but also wants to avoid generating excessive risk events for every single failure. Which approach best meets these requirements?

Which TWO types of events are typically categorized as 'Notable Events'?

Which command is used to remove duplicate events based on a field?

An analyst notices a Windows workstation repeatedly resolving long, random-looking subdomains under a single parent domain, followed by outbound DNS TXT queries. Which Splunk ES detection method is most appropriate to identify this as DNS tunneling?

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

Which TWO of the following are primary indicators of a phishing attack that you should look for in email logs?

Which TWO types of data are commonly enriched by the Asset and Identity framework?

Which TWO Splunk features are best for automating the execution of recurring threat hunts?

During a hunt for compromised accounts, you want to distinguish a legitimate helpdesk password reset from an attacker resetting credentials to retain access. Which correlation of events in Splunk would best support that distinction?

A security analyst is documenting the lifecycle of an investigation in Splunk Enterprise Security. Which statement accurately describes how cases and notables relate within that lifecycle?

During a threat hunt for data exfiltration, you want to identify endpoints that transferred an unusually large volume of data to external IP addresses compared to their normal baseline. Which Splunk approach best accomplishes this using the Network_Traffic data model?

You are a security analyst using Splunk Enterprise Security (ES) to map detections to the MITRE ATT&CK framework. Your CISO wants to understand which ATT&CK tactic is most directly addressed by the correlation search that detects suspicious PowerShell execution with encoded commands (T1059.001). Under which ATT&CK tactic should you classify this detection?

You are building a correlation search that must trigger a notable event when a user's risk score exceeds 100 within a 24-hour period. The risk score is calculated from multiple risk events across different indexes. Which Splunk ES component should you use to aggregate the risk events and evaluate the threshold?

When configuring a risk-based correlation search, what is the primary purpose of the 'Risk Analysis' adaptive response action?

You need to ensure that your Splunk ES environment is properly ingesting threat intelligence data. Where can you confirm that threat sources are active?

You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?

A security analyst receives a notable event about suspicious PowerShell execution on a workstation. To gather more context, the analyst wants to see all events related to the involved host from the last 24 hours in a single view. Which Splunk ES feature provides this consolidated timeline of activity for an entity?

Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?

A SOC manager wants to ensure that when a notable event is reviewed and closed, the analyst's disposition and any supporting evidence are preserved for audit purposes. Which Splunk ES feature should the manager use to capture this information?

A SOC analyst is building a risk-based alerting workflow and wants to ensure that a specific risk rule only contributes to an entity's risk score when the entity is a user account, not a system or IP address. Which configuration in the risk rule's search definition accomplishes this?

A Splunk ES analyst is investigating an alert for a suspicious PowerShell script execution. The alert is mapped to MITRE ATT&CK technique T1059.001 (PowerShell). To gather more context, the analyst wants to search for related events across multiple data sources. Which Splunk ES feature should they use to pivot from the alert to relevant events?