Courseiva

CCNA Threat Hunting Questions

31 questions · Threat Hunting · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selectmedium

You are hunting for evidence that an adversary is using scheduled tasks to maintain persistence on Windows endpoints. Which TWO data sources or artifacts should you prioritize reviewing in Splunk for this hunt? (Choose two.)

Select 2 answers
A.Sysmon Event ID 11, which records file creation events
B.Windows Security Event ID 4698, which records that a scheduled task was created
C.Windows Security Event ID 7045 from the System log, which records service installation
D.Sysmon Event ID 1 process creation events referencing schtasks.exe with a create argument
E.Windows Security Event ID 4625, which records failed logon attempts
AnswersB, D

Event ID 4698 is generated when a scheduled task is created and includes details such as the task name and the account that registered it. Reviewing it directly surfaces newly created persistence mechanisms and lets you correlate the creating account with suspicious activity. It is a primary artifact for scheduled-task persistence hunting and pairs well with task content analysis.

Why this answer

Scheduled-task persistence leaves two complementary traces: the Security log records task creation as Event ID 4698, while Sysmon process creation captures the schtasks.exe command line with its arguments and parent process. Combining them lets an analyst confirm that a task was registered and understand exactly what it will execute, which is essential for validating persistence rather than merely suspecting it.

Exam trap

The trap here is treating any persistence-related event, such as service installation, as equivalent to scheduled-task evidence, when only task-creation artifacts actually confirm this technique.

Practice this question →
2
MCQmedium

During a proactive hunt for Kerberoasting in an Active Directory environment, you ingest Windows Security Event Code 4769 with the service ticket options field available as Ticket_Options. You want to isolate requests made with weak RC4 encryption rather than AES. Which Splunk search best surfaces these potentially malicious service ticket requests?

A.index=wineventlog EventCode=4769 Ticket_Options=0x40810000 | stats count by Account_Name, Service_Name
B.index=wineventlog EventCode=4769 Ticket_Encryption_Type=0x17 | stats count values(Service_Name) by Account_Name
C.index=wineventlog EventCode=4768 Ticket_Encryption_Type=0x17 | stats count by Account_Name, Service_Name
D.index=wineventlog EventCode=4769 | where Ticket_Options="AES256" | stats count by Account_Name
AnswerB

Event Code 4769 records Kerberos service ticket requests, and the encryption type field value 0x17 (decimal 23) indicates RC4-HMAC. Attackers performing Kerberoasting commonly request RC4-encrypted service tickets because they are easier to crack offline, so filtering on this value and aggregating by account and service name directly isolates the suspicious pattern.

Why this answer

Kerberoasting abuses Kerberos service ticket requests, which are recorded in Security Event Code 4769. Because the attack relies on extracting tickets encrypted with the weaker RC4-HMAC algorithm for offline cracking, filtering on the encryption type value 0x17 and aggregating by account and service name produces a focused list of candidate activity that an analyst can triage further.

Exam trap

The trap here is confusing the Kerberos TGT request event code 4768 with the service ticket request event code 4769, which causes hunters to monitor the wrong authentication flow entirely.

Practice this question →
3
MCQeasy

When drafting a threat hunting playbook, which of the following sections is most critical for ensuring the hunt is repeatable and auditable by other analysts?

A.Threat Intelligence Source List
B.Hunt Procedure and Query Logic
C.Executive Summary
D.Hardware Requirements
AnswerB

Documenting the procedure and the exact SPL queries lets another analyst rerun the same hunt and reproduce findings. This satisfies the stem's repeatability and auditability requirement, since the query logic records precisely what was searched and how results were interpreted.

Why this answer

The Hunt Procedure and Query Logic section documents the exact steps, SPL queries, data sources, and expected outputs of the hunt. This is what makes the playbook repeatable by another analyst and auditable later, because it captures the reproducible method rather than just the outcome. Without it, the playbook is not a procedure.

Exam trap

SPLK-5001 often tests the difference between documentation that supports leadership reporting (Executive Summary) and documentation that supports operational repeatability (Hunt Procedure and Query Logic), so candidates who pick the intel source list because it 'sounds technical' fall into the trap.

How to eliminate wrong answers

Option A is wrong because a Threat Intelligence Source List identifies where intel comes from but does not describe how the hunt is executed or reproduced. Option C is wrong because an Executive Summary is a high-level overview for leadership and lacks the technical detail needed for repeatability. Option D is wrong because Hardware Requirements are infrastructure concerns and have nothing to do with the analytical procedure or auditability.

Practice this question →
4
MCQmedium

You are hunting for evidence of pass-the-hash lateral movement in your environment. Which Windows Security event and field combination is most indicative of this technique?

A.Event ID 4648 with TargetUserName=SYSTEM
B.Event ID 4672 with PrivilegeList containing SeDebugPrivilege
C.Event ID 4776 with Status=0x0
D.Event ID 4624 with LogonType=3 and LogonProcessName=NtLmSsp
AnswerD

Pass-the-hash authentication often uses NTLM, which logs as LogonType 3 (network) with LogonProcessName NtLmSsp. This combination indicates a network logon using NTLM, which is characteristic of hash-based authentication. It is a strong starting point for identifying lateral movement via stolen hashes.

Why this answer

Pass-the-hash uses NTLM authentication with a stolen hash, resulting in network logons. Event ID 4624 with LogonType 3 and LogonProcessName NtLmSsp captures this pattern. While not exclusive to pass-the-hash, it is the most direct indicator among the options and can be correlated with source hosts and account behavior.

Exam trap

The trap here is focusing on NTLM validation events (4776) or privilege assignment (4672) instead of the actual network logon that reveals the authentication method.

Practice this question →
5
MCQeasy

Which phase of the proactive threat hunting methodology involves identifying the specific threat actor or technique to be investigated?

A.Data Preparation
B.Reporting
C.Hunt Execution
D.Hypothesis Generation
AnswerD

Hypothesis Generation is the phase where hunters formulate a testable proposition about a specific threat actor or technique, defining what to investigate before data collection begins. It directly satisfies the stem's requirement to identify the actor or technique, preceding data gathering and analysis phases.

Why this answer

Hypothesis Generation is the phase of the proactive threat hunting methodology where the hunter formulates a specific, testable hypothesis about a threat actor, technique, or behavior to investigate. This phase defines what to hunt for, based on threat intelligence, ATT&CK techniques, or environmental anomalies, before any data collection or execution occurs.

Exam trap

SPLK-5001 often tests the ordering of hunting phases, where candidates confuse Hypothesis Generation with Hunt Execution or Data Preparation, not realizing the hypothesis must be defined before data is prepared or queries are run.

How to eliminate wrong answers

Option A is wrong because Data Preparation involves collecting, normalizing, and making data available for hunting, which happens after the hypothesis is defined. Option B is wrong because Reporting is the final phase where findings are documented and shared, not where the threat actor is identified. Option C is wrong because Hunt Execution is where the hypothesis is tested against data using queries and analytics, which follows hypothesis generation.

Practice this question →
6
MCQmedium

You are hunting for living-off-the-land binary (LOLBin) abuse on Windows endpoints. You have Sysmon EventCode 1 process creation logs. Which search best surfaces suspicious use of a signed Microsoft binary to download or execute remote content?

A.index=sysmon EventCode=1 | stats dc(Image) as distinct_binaries by Computer | where distinct_binaries > 50
B.index=sysmon EventCode=1 | search ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe" | stats count by Image
C.index=sysmon EventCode=1 | where match(CommandLine, "(?i)(certutil|bitsadmin|mshta|regsvr32).*(-urlcache|-transfer|-decode|http)") | table _time, Computer, User, Image, CommandLine
D.index=sysmon EventCode=1 | search Image="*\\powershell.exe" | stats count by CommandLine | sort -count
AnswerC

This search targets the specific command-line patterns that indicate LOLBin abuse, such as certutil with -urlcache or -decode, and bitsadmin with -transfer. Matching on the combination of a signed binary and a remote-download or decode switch isolates the technique while producing a reviewable list of events with full context.

Why this answer

LOLBin abuse is identified by the combination of a legitimate signed binary and command-line switches that download or execute remote content. Matching patterns such as certutil -urlcache or bitsadmin -transfer against Sysmon process creation events isolates the technique and preserves the command-line context needed for analyst review, unlike frequency-based or parent-process approaches.

Exam trap

The trap here is assuming that any appearance of a signed Microsoft binary like certutil or PowerShell is malicious, when the suspicious signal is the specific download or decode argument paired with it.

Practice this question →
7
Multi-Selectmedium

When designing a threat hunting playbook, which TWO components must be included to ensure the hunt is actionable?

Select 2 answers
A.The budget for the security department
B.A copy of the company's network topology map
C.Detailed SPL search queries
D.A list of all employees in the company
E.Incident response escalation steps
AnswersC, E

Detailed SPL search queries translate a hunting hypothesis into executable searches across indexed data, satisfying the requirement that the playbook be actionable rather than merely conceptual. They specify the exact fields, commands and time windows analysts run, ensuring consistent, repeatable detection of the targeted adversary behaviour during the hunt.

Why this answer

Option C is correct because a threat hunting playbook must contain detailed SPL (Search Processing Language) queries so analysts can actually execute the hunt against SIEM data in Splunk and pivot on the specific fields, indicators, or behaviors being sought; without concrete queries the hunt is theoretical rather than actionable. Option E is correct because incident response escalation steps define what happens when a hunt uncovers malicious activity — who is notified, within what timeframe, and through which channels — which converts a detection into a coordinated, actionable response rather than an unaddressed finding. Options A, B, and D do not belong: the security department budget is a management concern, not a hunt execution component; a network topology map can provide useful context but is not a required element for making a hunt actionable; and a list of all employees is an HR/PII inventory that does not drive hunt execution or escalation.

Exam trap

SPLK-5001 often tests the confusion between contextual documents (topology maps, employee lists) and operational components (SPL queries, escalation steps), tempting candidates to select reference material over executable content.

Practice this question →
8
MCQeasy

You are hunting for evidence of data exfiltration over HTTP. You have web proxy logs ingested into Splunk and want to identify internal hosts that have uploaded an unusually large amount of data to external sites in the past week. Which field in the proxy logs is most relevant for measuring outbound data volume?

A.status_code
B.uri_path
C.bytes_out
D.bytes_in
AnswerC

bytes_out represents the number of bytes sent from the client to the server, which directly measures outbound data volume. In the context of data exfiltration, a high bytes_out value to an external site indicates that an internal host is uploading a significant amount of data. This field is the most relevant for identifying potential exfiltration, as it quantifies the data leaving the network.

Why this answer

To detect data exfiltration, you must measure the volume of data leaving the network. In proxy logs, bytes_out captures the bytes sent from the internal host to the external server. Aggregating bytes_out per internal host and comparing against a baseline reveals anomalies indicative of exfiltration.

Other fields like status_code or uri_path do not quantify data volume.

Exam trap

The trap here is confusing bytes_in with bytes_out; bytes_in measures downloaded data, while exfiltration requires analyzing uploaded data, which is bytes_out.

Practice this question →
9
Multi-Selecthard

You are hunting for anomalous PowerShell activity. Which THREE indicators or behaviors should you look for in your Splunk data?

Select 3 answers
A.Presence of '-enc' or '-encodedcommand' flags
B.Execution of 'Get-Service' commands
C.PowerShell spawning processes like 'wmic.exe' or 'certutil.exe'
D.User logons via RDP
E.Network connections originating from 'powershell.exe'
AnswersA, C, E

Base64-encoded commands hide intent from casual inspection, so '-enc' or '-encodedcommand' flags in process command lines are a high-fidelity anomaly indicator. This satisfies the scenario's need for behavioural indicators detectable directly within Splunk process-execution telemetry.

Why this answer

Option A is correct because the -enc or -encodedcommand flags let attackers pass Base64-encoded scripts that evade plaintext command-line inspection, a classic sign of obfuscated PowerShell abuse. Option C is correct because PowerShell spawning LOLBins such as wmic.exe or certutil.exe indicates living-off-the-land tradecraft used for reconnaissance, download, or execution, which is highly anomalous for normal admin scripts. Option E is correct because outbound network connections originating from powershell.exe often reveal C2 beaconing, download cradles, or reverse shells, since legitimate PowerShell rarely initiates external connections.

Option B is not a strong indicator because Get-Service is a routine, benign cmdlet used constantly by administrators and monitoring tools. Option D is not PowerShell-specific, as RDP logons are a separate authentication event that does not by itself indicate anomalous PowerShell behavior.

Exam trap

SPLK-5001 often tests whether candidates confuse generic administrative activity (like Get-Service or RDP logons) with genuine PowerShell attack tradecraft, so pick indicators tied to obfuscation, LOLBin spawning, or outbound network behavior.

Practice this question →
10
MCQeasy

An analyst is hunting for evidence that an adversary used the Windows command shell to spawn a script interpreter in a suspicious parent-child relationship. The endpoint telemetry is in Splunk via Sysmon EventCode 1. Which search most directly surfaces processes whose parent is cmd.exe and whose image is a scripting engine?

A.index=sysmon EventCode=1 Image="*\\cmd.exe" | table _time, ComputerName, CommandLine
B.index=sysmon EventCode=3 ParentImage="*\\cmd.exe" | table _time, ComputerName, DestinationIp, DestinationPort
C.index=sysmon EventCode=1 | stats count by Image | sort - count | head 20
D.index=sysmon EventCode=1 ParentImage="*\\cmd.exe" Image IN ("*\\powershell.exe","*\\wscript.exe","*\\cscript.exe","*\\mshta.exe") | table _time, ComputerName, ParentImage, Image, CommandLine
AnswerD

This search keys on the parent-child relationship, requiring the parent image to be cmd.exe and the child image to be a scripting engine such as PowerShell, WScript, CScript, or Mshta. That combination is a classic living-off-the-land pattern for scripted execution, so it directly surfaces the behavior described while keeping noise manageable through the constrained image list.

Why this answer

Process creation telemetry from Sysmon EventCode 1 includes both the Image and ParentImage fields, enabling lineage-based hunting. Constraining ParentImage to cmd.exe and Image to a set of scripting engines isolates the living-off-the-land execution pattern where a shell launches an interpreter, which is a common step in scripted intrusions and worth triaging.

Exam trap

The trap here is filtering on the Image field for cmd.exe, which finds shell launches themselves, instead of using ParentImage to find what the shell spawned.

Practice this question →
11
MCQhard

When utilizing the Splunk Common Information Model (CIM), which field name is standard for identifying the destination IP address across different data sources?

A.dst_ip
B.remote_address
C.dest
D.target_ip
AnswerC

The CIM normalises destination address fields across disparate data sources into the standard dest field, enabling consistent correlation regardless of vendor naming. This directly satisfies the stem's requirement for a standard field identifying the destination IP address.

Why this answer

The Splunk Common Information Model (CIM) standardizes field names to enable consistent searching and reporting across diverse data sources. For network traffic data models, the CIM specifies 'dest' as the canonical field for the destination IP address. This normalization allows analysts to write a single search (e.g., `| tstats ... where nodename=All_Traffic`) that works regardless of whether the underlying source used 'dst_ip', 'remote_address', or 'target_ip'.

Option C is correct because 'dest' is the exact field name defined in the CIM's Network Traffic data model.

Exam trap

SPLK-5001 often tests candidates' ability to distinguish between common vendor-specific field names and the standardized CIM field names, so confusing 'dst_ip' (a frequent alias) with 'dest' (the CIM standard) is a classic trap.

How to eliminate wrong answers

Option A is wrong because 'dst_ip' is a common vendor-specific field name (e.g., in some firewall logs) but is not the CIM-standardized name; the CIM uses 'dest' instead. Option B is wrong because 'remote_address' is a generic term often found in application logs or Windows events, but it is not part of the CIM specification for network traffic. Option D is wrong because 'target_ip' is not a CIM-defined field; while it may appear in custom extractions, it does not conform to the CIM's naming conventions.

Practice this question →
12
MCQmedium

You are hunting for Kerberoasting activity in your Windows environment. You have Splunk ingesting Windows Security event logs. Which Event ID and field combination best supports identifying accounts requesting service tickets with weak encryption?

A.Event ID 4771 with FailureCode=0x18
B.Event ID 4768 with TicketOptions=0x40810010
C.Event ID 4769 with TicketEncryptionType=0x17 and ServiceName not ending in $
D.Event ID 4624 with LogonType=3 and AccountName ending in $
AnswerC

Event ID 4769 logs Kerberos service ticket requests. TicketEncryptionType 0x17 indicates RC4, which is weak and commonly requested by Kerberoasting tools. Excluding machine accounts ending in $ focuses on user accounts, which are the typical targets for offline password cracking.

Why this answer

Kerberoasting involves requesting Kerberos service tickets for accounts with SPNs and then cracking them offline. Event ID 4769 records these requests, and RC4 encryption type 0x17 is the weak cipher attackers prefer. Filtering out machine accounts ending in $ narrows results to user accounts, which are the realistic targets.

Exam trap

The trap here is selecting the TGT event (4768) instead of the service ticket event (4769), or overlooking the encryption type field that distinguishes Kerberoasting.

Practice this question →
13
Multi-Selectmedium

Which TWO actions should be performed during the 'Data Preparation' phase of a threat hunt to ensure accurate results?

Select 2 answers
A.Mapping data sources to the Splunk Common Information Model (CIM)
B.Applying machine learning models
C.Creating new user accounts
D.Verifying data availability for the required time range
E.Drafting the final incident report
AnswersA, D

Mapping sources to the Splunk Common Information Model normalises disparate field names and formats into a shared schema, letting searches and correlations run consistently across heterogeneous data. This directly satisfies the stem's accuracy constraint, since unnormalised fields would cause missed or mismatched events during the hunt.

Why this answer

Option A is correct because mapping data sources to the Splunk Common Information Model (CIM) normalizes fields and event types (e.g., src, dest, user, action) across heterogeneous sources, so searches and correlation rules return consistent, accurate results during the hunt. Option D is correct because verifying data availability for the required time range confirms that the relevant indexes, sourcetypes, and retention policies actually contain the events covering the hunt's window, preventing false negatives caused by missing or aged-out data. Together, these two actions ensure the data is both semantically aligned and temporally complete before analysis begins.

Option B is not part of Data Preparation; applying machine learning models belongs to later analysis or detection phases. Option C is unrelated, as creating user accounts is an administrative access task, not a data preparation step. Option E is incorrect because drafting the final incident report occurs at the conclusion of the hunt, after findings have been validated.

Exam trap

SPLK-5001 often tests the ordering of the threat hunting lifecycle, tricking candidates into selecting analysis-phase activities like ML or reporting as if they were Data Preparation steps.

Practice this question →
14
MCQeasy

In a threat hunting workflow, what is the primary purpose of a 'Lookback' period?

A.To increase the search speed
B.To clear the cache
C.To reduce the number of false positives
D.To align with attacker dwell time
AnswerD

Lookback windows are sized to match attacker dwell time, the interval between initial compromise and detection. Hunting over that retrospective period surfaces evidence of intrusions that evaded real-time alerting, satisfying the requirement to uncover stealthy, long-resident threats rather than only current activity.

Why this answer

The primary purpose of a 'Lookback' period in threat hunting is to align with attacker dwell time, which is the time an attacker remains undetected in a network. By setting a lookback period that covers the typical dwell time, hunters can search for indicators of compromise over a relevant historical window, increasing the chances of detecting ongoing or past intrusions.

Exam trap

SPLK-5001 often tests the purpose of lookback, and candidates may incorrectly associate it with performance optimization rather than aligning with attacker dwell time.

How to eliminate wrong answers

Option A is wrong because lookback does not increase search speed; it defines the time range for the search. Option B is wrong because clearing the cache is unrelated to lookback. Option C is wrong because reducing false positives is not the primary purpose; lookback is about covering the time window where attacker activity may reside.

Practice this question →
15
MCQmedium

You are hunting for evidence of credential dumping. You have access to Sysmon logs. Which EventCode should be the primary focus for detecting memory access to lsass.exe?

A.EventCode 1
B.EventCode 11
C.EventCode 10
D.EventCode 3
AnswerC

EventCode 10 records process access, capturing one process opening a handle to another with granted access rights. Memory access to lsass.exe by a non-standard process appears here, making it the primary Sysmon event for credential-dumping detection.

Why this answer

Sysmon EventCode 10 is the correct answer because it specifically logs process access events, including when a process opens a handle to another process with memory-read permissions. Credential dumping tools such as Mimikatz must access lsass.exe memory to extract credentials, so EventCode 10 with a TargetImage of lsass.exe and a GrantedAccess mask indicating read access is the primary detection signal. This event is the most direct Sysmon telemetry for identifying LSASS memory access.

Exam trap

SPLK-5001 often tests the specific Sysmon EventCode numbers, tricking candidates into choosing EventCode 1 (process creation) because they associate 'process' with credential dumping rather than the memory-access event.

How to eliminate wrong answers

Option A (EventCode 1) is wrong because it logs process creation, which shows a tool launched but not that it accessed LSASS memory. Option B (EventCode 11) is wrong because it logs file creation, which is relevant to dropped files but not to memory access. Option D (EventCode 3) is wrong because it logs network connections, which could show exfiltration but not the credential-dumping memory access itself.

Practice this question →
16
MCQhard

You are hunting for persistence via Windows scheduled tasks. You have Splunk ingesting Windows Event Logs and Sysmon. Which Event ID and field should you prioritize to detect a newly created scheduled task that runs a suspicious binary?

A.Event ID 4688 with NewProcessName
B.Event ID 106 with TaskName
C.Event ID 1 with CommandLine containing schtasks
D.Event ID 4698 with TaskContent containing the binary path
AnswerD

Event ID 4698 is logged when a scheduled task is created. The TaskContent field contains the XML definition of the task, including the action's executable path. Filtering for suspicious paths or binaries in TaskContent directly detects malicious scheduled task persistence.

Why this answer

Scheduled task creation is best detected via Windows Security Event ID 4698, which includes the full task definition in TaskContent. This allows you to inspect the executable path and arguments for suspicious binaries. Relying on process creation events may miss tasks created through other interfaces.

Exam trap

The trap here is focusing on process creation events like 4688 or Sysmon 1, which show execution but not the creation of the persistence mechanism itself.

Practice this question →
17
MCQhard

While hunting for Kerberos-based attacks, you notice a service account requesting service tickets for many distinct SPNs across multiple servers within a short window. You want to correlate this with the account's normal baseline to confirm abnormal breadth. Which approach most directly supports that analysis in Splunk?

A.Search EventCode 4776 and use stats values(user) by workstation to list accounts validated on each host
B.Run a search for EventCode 4769, then use eventstats to compute the average number of distinct service names per account over the prior 30 days and compare the current hour against that baseline
C.Search EventCode 4768 and use timechart to plot authentication ticket requests per account over 24 hours
D.Search EventCode 4624 and use transaction to group logon events by account, then count the number of source workstations per session
AnswerB

EventCode 4769 records Kerberos service ticket requests, and computing distinct service names per account establishes the breadth baseline. Eventstats lets you attach the historical average to each current event so you can flag accounts whose current-hour SPN diversity far exceeds their norm. That directly isolates abnormal service-ticket breadth consistent with kerberoasting reconnaissance or service account abuse.

Why this answer

Kerberos service ticket requests are logged as EventCode 4769, and the hunt hinges on measuring how many distinct service names a given account requests relative to its own history. Attaching a per-account baseline with eventstats and comparing the current window exposes accounts whose SPN breadth suddenly expands, a pattern consistent with kerberoasting or misuse of a privileged service account.

Exam trap

The trap here is confusing the Kerberos ticket-granting ticket event with the service ticket event, so analysts baseline logon volume instead of SPN diversity.

Practice this question →
18
Multi-Selecthard

Which THREE techniques can be used in Splunk to reduce the noise of false positives during a threat hunt?

Select 3 answers
A.Deleting raw logs after indexing
B.Using 'NOT' clauses to exclude known administrative processes
C.Increasing the search time range
D.Implementing lookup tables to exclude known-good baselines
E.Adjusting the threshold for rarity in the 'rare' command
AnswersB, D, E

Excluding known administrative processes with 'NOT' clauses directly suppresses benign activity that would otherwise trigger detections, satisfying the requirement to reduce false-positive noise during hunting. Filtering trusted executables at search time narrows results to genuinely suspicious events, so analysts spend less effort triaging routine administrative behaviour.

Why this answer

Option B is correct because adding 'NOT' clauses to a search (e.g., NOT process_name=svchost.exe) filters out known administrative or benign processes, directly suppressing events that would otherwise generate false positives during a hunt. Option D is correct because lookup tables let you maintain an external list of known-good baselines (IPs, hashes, accounts) and exclude them via lookup-based filtering, which is a standard Splunk method for whitelisting trusted activity. Option E is correct because the 'rare' command's threshold parameter controls how infrequently a value must occur to be reported; raising or tuning that threshold prevents low-frequency but legitimate events from being flagged as suspicious.

Option A is wrong because deleting raw logs after indexing destroys forensic evidence and is not a noise-reduction technique. Option C is wrong because increasing the search time range expands the data examined and typically increases, not reduces, false positives.

Exam trap

SPLK-5001 often tests the misconception that increasing search time range improves detection, when in fact it can increase noise; candidates must recognize that noise reduction requires targeted filtering, not broader searches.

Practice this question →
19
Multi-Selecthard

You are conducting a threat hunt for data exfiltration over DNS. Which TWO Splunk search techniques are most effective for identifying anomalous DNS tunneling activity in your DNS logs? (Choose two.)

Select 2 answers
A.Count the number of unique source IPs per DNS server and alert when the count exceeds a fixed threshold of 100.
B.Use the eventstats command to compute the standard deviation of query counts per host and alert on hosts exceeding three standard deviations.
C.Filter for DNS query types A and AAAA only, then sort by query name alphabetically.
D.Search for DNS queries containing the string 'malware' in the query name.
E.Calculate the average query length per domain and flag domains with unusually long subdomain labels.
AnswersB, E

Eventstats calculates statistical measures across events without collapsing them. Computing standard deviation of query counts per host and flagging outliers identifies hosts generating abnormal DNS volume, which is a hallmark of tunneling. This method adapts to your environment's baseline and highlights deviations for further review.

Why this answer

DNS tunneling hides data in long, high-entropy subdomains and generates abnormal query volumes. Statistical profiling of query length and query count per host identifies deviations from normal DNS behavior without relying on known indicators. These techniques are proactive and can detect new tunneling domains.

Exam trap

The trap here is relying on signature-based keyword searches or fixed thresholds, which fail against novel DNS tunneling that blends into normal traffic.

Practice this question →
20
MCQeasy

Which Splunk feature allows an analyst to save a specific search query, parameterize it with variables, and reuse it across different time ranges and entities?

A.Saved Search
B.Data Model Acceleration
C.Search Macro
D.Event Type
AnswerC

Search macros store a reusable search fragment, optionally with arguments, letting analysts parameterise values such as time ranges or entities and invoke the same logic across many searches. This directly satisfies the requirement to save, parameterise, and reuse a query.

Why this answer

A Search Macro in Splunk allows you to save a search query with variables (arguments) that can be reused across different searches, time ranges, and entities. It supports parameterization, enabling analysts to define placeholders that are replaced at runtime, making it ideal for reusable and dynamic searches.

Exam trap

SPLK-5001 often tests the confusion between Saved Searches and Search Macros, where candidates might think Saved Searches support parameterization, but only macros provide that capability.

How to eliminate wrong answers

Option A is wrong because a Saved Search is a static query that can be scheduled or run as-is; it does not support parameterization with variables for reuse across different entities. Option B is wrong because Data Model Acceleration is a performance optimization for data models, not a mechanism for saving and parameterizing searches. Option D is wrong because an Event Type is a method to categorize events based on search criteria, but it does not allow parameterization or reuse of a search query with variables.

Practice this question →
21
Multi-Selecthard

You are hunting for DNS-based data exfiltration using Splunk, where malware encodes stolen data in subdomain labels of queries to an attacker-controlled domain. Which two search constructs most directly help you quantify abnormally long or high-entropy query names and identify the destination domain being abused? (Choose two.)

Select 2 answers
A.Use the lookup command with a threat intelligence feed of known malicious IP addresses and drop every DNS event whose source is not in the feed.
B.Use rex to extract the query name into a field, then apply eval len() on the query and stats avg(len) by query to find unusually long names.
C.Use the dedup command on the query field to remove repeated queries and then count the remaining events per host to determine exfiltration volume.
D.Use eval to compute the length of each DNS query and the count of unique subdomains per parent domain, then use eventstats or stats to rank the parent domains by these metrics.
E.Use the transaction command to group all DNS events from a single source IP over a 30-minute window into one event and inspect the raw payload.
AnswersB, D

DNS tunneling embeds data in subdomain labels, so the query names become far longer than typical hostnames. Extracting the query field with rex and measuring its length, then aggregating average length per query or per base domain, surfaces the statistical outlier pattern that characterizes encoded exfiltration traffic, making this a direct and effective hunting construct.

Why this answer

DNS exfiltration hides data in the length and variability of subdomain labels, so the strongest hunting constructs extract the query name and quantify its length and the number of unique subdomains per parent domain. Ranking parent domains by these metrics exposes the destination being abused and separates tunneling from ordinary resolution traffic without depending on pre-existing threat intelligence.

Exam trap

The trap here is assuming an existing threat intelligence lookup will catch DNS exfiltration, when novel attacker domains are precisely what proactive hunting must discover through statistical anomaly.

Practice this question →
22
MCQeasy

You are preparing a hunt for suspicious PowerShell execution and want to search only the accelerated data model rather than raw events to return results faster across a large environment. Which Splunk construct should you use?

A.The pivot interface filtered to the Processes dataset
B.The datamodel command with the search clause to filter Process events
C.The tstats command against the Endpoint data model with the Processes dataset
D.The from command reading the Endpoint.Processes dataset directly
AnswerC

The tstats command queries accelerated data models directly, returning results far faster than raw event searches across large indexes. The Endpoint data model's Processes dataset contains process execution details including command line and parent process, which is exactly what a PowerShell execution hunt needs. This is the standard accelerated approach for endpoint process hunting at scale.

Why this answer

Accelerated data models exist precisely so that high-volume hunts can run quickly over summarized data. The tstats command is the purpose-built tool for querying those models, and the Endpoint data model's Processes dataset holds the process name, command line, and parent process fields needed to find suspicious PowerShell execution. Using it keeps the hunt fast and repeatable across a large estate.

Exam trap

The trap here is reaching for the datamodel or from commands, which can query models but do not exploit acceleration as directly as the command designed for summarized model searches.

Practice this question →
23
MCQmedium

You are investigating a suspicious PowerShell script. You suspect the script is using Base64 encoding. Which SPL function can you use to decode the string within Splunk?

A.eval decoded=base64_decode(field)
B.rex field=field "(?<decoded>.*)"
C.transform base64 field
D.eval decoded=decode(field, "base64")
AnswerA

The eval function base64_decode() converts a Base64-encoded string back to plaintext within a search, so the encoded PowerShell payload becomes readable. Applying it to the suspect field satisfies the stem's requirement to decode the string directly in Splunk.

Why this answer

The eval command with base64_decode function (A) is the correct SPL function to decode a Base64-encoded string. It takes a field containing Base64 data and returns the decoded string, which can then be analyzed.

Exam trap

SPLK-5001 often tests the misconception that rex or other commands can decode Base64, when the specific eval function base64_decode is required.

How to eliminate wrong answers

Option B is wrong because rex is a regex command for field extraction, not for Base64 decoding. Option C is wrong because 'transform base64 field' is not valid SPL syntax. Option D is wrong because there is no 'decode' function in SPL; the correct function is base64_decode.

Practice this question →
24
MCQmedium

You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?

A.index=windows EventCode=4697 | table User, ServiceName
B.index=windows EventCode=4688 | stats count by ParentProcessName, ProcessName
C.index=windows EventCode=4624 | table Logon_Type, User
D.index=windows EventCode=7045 | stats count by ServiceName
AnswerB

Aggregating EventCode 4688 by parent and child process directly surfaces wmiprvse.exe spawning shells such as cmd.exe or powershell.exe, satisfying the hunt's requirement to identify anomalous WMI process creation. The stats count by pair ranks frequency, letting you spot rare or unexpected parent-child combinations indicative of lateral movement.

Why this answer

EventCode 4688 is Windows Security logging for process creation, and it includes both the new process name and the parent process name. By using stats count by ParentProcessName, ProcessName, an analyst can spot wmiprvse.exe spawning unusual shells like cmd.exe or powershell.exe, which is a hallmark of WMI lateral movement. The other event codes cover service installation, logon activity, or service creation, not process lineage.

Exam trap

SPLK-5001 often tests the difference between process creation (4688) and other Windows event codes like 4697, 7045, or 4624, so candidates must memorize which event ID corresponds to which activity.

How to eliminate wrong answers

Option A is wrong because EventCode 4697 logs service installation in the Security log, not process creation, and it lacks parent-child process relationships. Option C is wrong because EventCode 4624 records logon events and Logon_Type, which does not reveal process spawning behavior. Option D is wrong because EventCode 7045 is a System log event for service creation, unrelated to WMI process ancestry.

Practice this question →
25
MCQhard

You are hunting for suspicious PowerShell activity on endpoints. You have PowerShell Script Block Logging (Event ID 4104) ingested into Splunk. Which search best identifies scripts that download and execute remote content, a common attacker technique?

A.index=win EventCode=4103 | stats count by ScriptBlockText
B.index=win EventCode=4104 | regex ScriptBlockText="^[A-Za-z0-9+/=]{100,}$"
C.index=win EventCode=4104 | where like(ScriptBlockText, "%DownloadString%") OR like(ScriptBlockText, "%Invoke-Expression%")
D.index=win EventCode=4104 | where like(ScriptBlockText, "%Get-Process%")
AnswerC

Event ID 4104 captures PowerShell script block text. Searching for DownloadString and Invoke-Expression identifies common download-and-execute patterns used by attackers. This combination is specific to remote payload retrieval and execution, making it an effective hunt query.

Why this answer

PowerShell Script Block Logging (4104) records the actual script text. Attackers frequently use DownloadString to fetch remote payloads and Invoke-Expression to execute them. Searching for these strings directly identifies the download-and-execute chain, which is a high-fidelity indicator of malicious PowerShell activity.

Exam trap

The trap here is confusing PowerShell event IDs, such as using 4103 module logging instead of 4104 script block logging, which contains the full script text.

Practice this question →
26
MCQhard

You are hunting for beaconing activity in proxy logs ingested into Splunk, where an implant contacts its command-and-control server at regular intervals with small jitter. Which analytic approach best identifies a host exhibiting this periodic communication pattern?

A.Aggregate bytes transferred per destination and alert when a single destination exceeds a fixed threshold of total data volume per hour.
B.Search for any destination whose fully qualified domain name was registered within the last 30 days using a passive DNS lookup and alert on all contacts to it.
C.Compute the standard deviation or variance of the inter-arrival times between successive connections from each host to each destination, then flag destinations with low variance and regular spacing.
D.Count total outbound connections per source host per day and alert on any host in the top decile of connection volume.
AnswerC

Beaconing produces connections at consistent intervals, so the time deltas between successive requests to the same destination cluster tightly and yield a low standard deviation. Measuring inter-arrival time variance per host-destination pair directly captures periodicity with jitter and is robust to the low volume that defeats volume-based approaches.

Why this answer

Periodic command-and-control check-ins reveal themselves through the regularity of connection timing rather than through volume. Calculating the variance of inter-arrival times between a host and each destination, then flagging pairs with low variance and consistent spacing, isolates beacon-like behavior even when jitter is present, because the underlying cadence remains far more regular than human or application traffic.

Exam trap

The trap here is equating beaconing with high traffic volume, when the defining characteristic is temporal regularity that volume-based thresholds cannot capture.

Practice this question →
27
MCQmedium

You suspect an attacker is using 'living-off-the-land' (LotL) techniques. Which Sysmon event should you analyze to see command-line arguments of suspicious utilities?

A.Event ID 7
B.Event ID 2
C.Event ID 5
D.Event ID 1
AnswerD

Sysmon Event ID 1 records process creation, including the full command line, parent process and hashes. This satisfies the LotL hunt because built-in utilities such as PowerShell or certutil appear as ordinary processes, and only their command-line arguments expose malicious use.

Why this answer

Sysmon Event ID 1 is the 'Process Create' event, which logs the full command line, image path, parent process, user, and hashes for every process launched. For detecting living-off-the-land techniques (e.g., powershell.exe, wmic.exe, certutil.exe with suspicious arguments), Event ID 1 is the definitive source for command-line arguments.

Exam trap

SPLK-5001 often tests Sysmon event ID memorization — candidates confuse Event ID 1 (Process Create) with Event ID 7 (Image Load) or Event ID 5 (Process Terminated), picking the wrong event for command-line analysis.

How to eliminate wrong answers

Option A (Event ID 7) is wrong because it logs Image Loaded events (DLL/module loads), which show which libraries a process loaded but not the command-line arguments used to launch it. Option B (Event ID 2) is wrong because it logs File Creation Time Changed events, which is a timestomping indicator, not process command lines. Option C (Event ID 5) is wrong because it logs Process Terminated events, which only record when a process ended, not how it was invoked.

Practice this question →
28
MCQeasy

During a proactive threat hunt, you want to quickly identify processes that were executed from a temporary directory such as C:\\Users\\Public on Windows endpoints, using Sysmon data. Which Splunk search is most appropriate to surface this activity?

A.index=sysmon EventCode=11 | where like(TargetFilename, "%Public%")
B.index=sysmon EventCode=3 | where like(DestinationIp, "%Public%")
C.index=sysmon | stats count by Image | where count < 5
D.index=sysmon EventCode=1 | where like(Image, "%\\Users\\Public\\%")
AnswerD

Sysmon EventCode 1 records process creation and includes the Image field with the full executable path. Filtering where Image contains the Public directory surfaces executions from that untrusted location, which is a common staging area for attackers and a valid hunt hypothesis.

Why this answer

Sysmon EventCode 1 is the process creation event and carries the Image field with the full path of the executable. Filtering on the Public directory isolates executions from a location where legitimate software rarely runs, which is a strong indicator of staging or malicious activity and directly supports the hunt hypothesis.

Exam trap

The trap here is confusing Sysmon event types, assuming any event with a file path can answer a process-execution question when only process creation records the image path.

Practice this question →
29
Multi-Selectmedium

Which TWO Splunk features are best for automating the execution of recurring threat hunts?

Select 2 answers
A.Data Model Acceleration
B.Scheduled Searches
C.User Roles
D.Alert Actions
E.Splunk Web Framework
AnswersB, D

Scheduled Searches run saved hunt queries automatically at defined intervals, removing manual re-execution. This directly satisfies the stem's recurring automation requirement by dispatching detections continuously, with results available for review or downstream alerting without analyst intervention.

Why this answer

Scheduled Searches (B) are correct because they let you run a saved search automatically on a cron-based schedule, which is exactly how recurring threat hunts are executed without manual intervention. Alert Actions (D) are correct because they attach automated responses to triggered alerts, such as running a script, sending an email, or invoking a webhook, enabling the hunt to act on findings automatically. Data Model Acceleration (A) only speeds up searches against data models; it does not schedule or automate hunt execution.

User Roles (C) govern access permissions and capabilities, not recurring task automation. Splunk Web Framework (E) is a development toolkit for building custom apps and dashboards, not a scheduling or automation mechanism for recurring hunts.

Exam trap

SPLK-5001 often tests the distinction between features that accelerate or visualize searches (Data Model Acceleration, dashboards) and features that actually automate recurring execution (Scheduled Searches plus Alert Actions), so candidates who pick acceleration features fall into the trap.

Practice this question →
30
MCQhard

During a hunt for compromised accounts, you want to distinguish a legitimate helpdesk password reset from an attacker resetting credentials to retain access. Which correlation of events in Splunk would best support that distinction?

A.Correlate Event ID 4688 process creation with Event ID 5156 network connection allowed and group by parent process
B.Correlate Event ID 4724 (password reset attempt) with the initiating account and compare the target account's subsequent logon source IPs against its historical baseline
C.Correlate Event ID 4768 with Event ID 4769 and count ticket requests per account within a five-minute window
D.Correlate Event ID 4624 logon type 3 with Event ID 4672 special privileges assigned and group by destination host
AnswerB

Event ID 4724 records a password reset attempt and identifies the account performing the reset. Correlating the reset actor with the target account's later logon locations reveals whether the target then authenticates from unfamiliar addresses, a strong indicator of attacker-driven resets for access retention. Comparing against the target's historical source IP baseline separates routine helpdesk activity from abuse.

Why this answer

Password reset activity is captured by Event ID 4724, which includes the account performing the reset. The key discriminator is what happens next: if the target account subsequently authenticates from source addresses outside its historical pattern, the reset likely served attacker access retention rather than routine support. Correlating the reset actor with the target's later logon geography turns a benign-looking event into a defensible finding.

Exam trap

The trap here is focusing on authentication volume events, which describe tickets and logons, instead of the specific event that records who performed a password reset.

Practice this question →
31
MCQeasy

During a threat hunt for data exfiltration, you want to identify endpoints that transferred an unusually large volume of data to external IP addresses compared to their normal baseline. Which Splunk approach best accomplishes this using the Network_Traffic data model?

A.Search for DNS queries to newly registered domains and assume any resolution indicates exfiltration.
B.Run a raw search over index=firewall and manually review the top talkers by bytes for the past hour.
C.Create an alert that fires whenever any host sends more than 1 GB in an hour, regardless of its typical usage.
D.Use tstats to compute per-host outbound bytes from Network_Traffic.All_Traffic, then compare each host's recent total to its historical average and flag significant deviations.
AnswerD

This approach uses the accelerated data model for efficient aggregation, computes outbound volume per host, and compares recent activity against a historical baseline. Flagging deviations above normal behavior isolates hosts whose transfer volume is anomalous for them, which is precisely the signal of potential exfiltration.

Why this answer

Exfiltration detection hinges on identifying hosts whose outbound transfer volume deviates from their own historical norm. Aggregating bytes per host through the accelerated Network_Traffic data model and comparing recent totals to a baseline surfaces those deviations efficiently, while static thresholds or unrelated DNS signals fail to capture the volume anomaly.

Exam trap

The trap here is applying a fixed byte threshold across all hosts instead of comparing each host against its own established baseline.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Threat Hunting questions.

Start 20-question session