troubleshooting

Which TWO of the following are key components of a successful incident investigation workflow in Splunk ES?

Which THREE tasks are performed within the 'CIM Setup' interface?

What is the purpose of the 'head' command?

An attacker is using a technique that involves 'living off the land' by utilizing legitimate system tools. Which data model is most effective to monitor these tools?

You are configuring the Splunk Security Essentials (SSE) app to align with the NIST CSF framework. You want to prioritize your detection development based on the most critical gaps. Which action should you take?

You need to ensure that only authorized users can view certain sensitive notable events. How do you implement this in Splunk ES?

When drafting a threat hunting playbook, which of the following sections is most critical for ensuring the hunt is repeatable and auditable by other analysts?

A security engineer is configuring a new correlation search that needs to correlate data across two different indexes. Which Splunk ES feature allows for efficient correlation across large datasets?

Which TWO of the following commands are used for data transformation or enrichment?

Which phase of the proactive threat hunting methodology involves identifying the specific threat actor or technique to be investigated?

A security analyst notices an alert from the 'MITRE ATT&CK - Initial Access' tactic. Which data source should be primary for investigating this alert?

Which character acts as a wildcard in a search string?

A user reports that a specific dashboard panel is timing out. After checking the search job, you notice it is scanning too much data. Which configuration should you adjust?

You are investigating a potential beaconing pattern. You have identified a suspect destination IP. Which SPL command sequence is most appropriate to calculate the frequency of connections to this IP to validate the beaconing hypothesis?

When configuring an 'Adaptive Response' action, what does the 'Notable' action type do?

Which Splunk Enterprise Security feature allows you to manage the lifecycle of a notable event?

An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?

You are using a subsearch to find 'dest_ip' values that appeared in a 'failed_login' search. What is a common limitation of subsearches that you must consider?

Which THREE pieces of information are commonly found in a Splunk ES Case?

Which TWO factors influence an object's final risk score in Splunk ES?

Which TWO commands provide information about the fields present in the events?

Which dashboard in Splunk ES provides a high-level view of threats and vulnerabilities mapped to the MITRE ATT&CK framework?

An analyst needs to manually add an event to an existing case in Splunk ES. What is the correct procedure?

Which THREE dashboard categories in Splunk ES are most useful for risk-based investigation?

Which THREE components are required for an Adaptive Response action to function?

You are creating a custom Adaptive Response action. The action requires a Python script. Where must this script be placed for the Splunk instance to execute it?

You are creating a custom correlation search that triggers a notable event. How do you ensure the notable event maintains the correct 'owner' assignment when the search triggers for multiple distinct users?

When designing a threat hunting playbook, which TWO components must be included to ensure the hunt is actionable?

An attacker has cleared the Windows Event Logs to hide their tracks. You are hunting for this activity. Which Event ID in the System log indicates that the log service was stopped or cleared?

You are investigating a user who has triggered multiple high-risk alerts. Where in Splunk ES can you view the historical risk score progression for this specific user?

Which THREE actions are part of the 'Incident Review' investigation workflow?

Which THREE of the following data sources are most valuable for detecting an insider threat?

What is the effect of changing the 'Retention Period' in the Enterprise Security app settings?

You are hunting for anomalous PowerShell activity. Which THREE indicators or behaviors should you look for in your Splunk data?

Which command is used to calculate the 'count' of events and concurrently keep the original 'raw' text?

When reviewing an incident, how can an analyst verify if the notable event was generated by a specific correlation search?

You have a field 'raw_data' containing JSON. How do you extract fields from it within your SPL search?

What is the purpose of the 'map' command in complex searches?

What is the purpose of the 'Investigation Workbench' in Splunk ES?

When investigating a risk notable, which dashboard in Splunk ES provides a visual representation of the risk contributors for a specific user?

What is the purpose of the 'Assets and Identities' framework in Splunk ES?

Which THREE of the following are necessary prerequisites for ensuring a new data source is correctly utilized by the ES 'Access' data model?

Which THREE of the following represent the categories of threat intelligence that can be managed within the Splunk Enterprise Security 'Threat Intelligence' framework?

A user account is exhibiting signs of being compromised. Where can you find the user's recent login history in Splunk ES?

Which TWO actions should be taken if a correlation search is consuming too many system resources?

You are configuring Splunk Enterprise Security to monitor for MITRE ATT&CK 'Persistence' techniques. Which TWO data sources provide the highest fidelity logs for detecting registry-based persistence?

In the Incident Review dashboard, what does 'Status' represent?

Which command is used to visualize data in a time-series chart?

You want to find the total count of events per hour over the last week. Which command sequence is most efficient?

When using the 'Risk Analysis' framework in Splunk ES, what is the primary benefit of assigning a 'Risk Object'?

A customer wants to exclude certain low-fidelity risk events from their Risk Notable correlation search. Where is the best place to define these exclusions?

You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?

What is the primary function of the 'Incident Review' dashboard in Splunk ES?

When utilizing the Splunk Common Information Model (CIM), which field name is standard for identifying the destination IP address across different data sources?

You want to dynamically update a lookup table with new indicators of compromise (IOCs) found during your search. Which command is used for this?

You notice a system process attempting to connect to a suspicious external domain. Which CIM data model would contain this network connection information?

What is the result of using 'bin _time span=1d'?

Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?

Which TWO actions should be performed during the 'Data Preparation' phase of a threat hunt to ensure accurate results?

Which TWO metrics are tracked in the 'Incident Review' dashboard's 'Notable Event' list?

An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?

Which THREE features are provided by the Splunk ES Incident Review dashboard?

Which field is mandatory for an event to be correctly categorized by the Common Information Model (CIM) 'Network Traffic' data model?

An attacker is attempting to use a 'Pass-the-Hash' technique. Which authentication log event code in Windows (Event ID 4624) should you look for to detect this?

Which THREE things are required for Splunk Enterprise Security to provide meaningful security insights?

If an analyst needs to modify the default retention for the 'risk' index, where should they make this change?

Where do you go in Splunk ES to adjust the sensitivity (risk score) of a specific correlation search?

Which THREE of the following components are part of the 'Endpoint' data model?

You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?

You are using 'lookup' to add user info. What happens if the common field doesn't exist in the lookup file?

Which TWO methods can be used to suppress unwanted notable events?

Which TWO factors are critical for effective Asset and Identity enrichment?

You are configuring a 'Notable Event' to use a specific 'Drilldown' link. What syntax is used to pass fields from the event into the URL?

When aligning Splunk Enterprise Security with the NIST CSF 'Recover' function, which feature is most applicable for documenting the incident response process?

Which TWO factors directly impact the urgency of a notable event in Splunk ES?

Which TWO commands require a grouping field to function correctly?

Which THREE of the following are common indicators that a host has been infected with malware?

In a threat hunting workflow, what is the primary purpose of a 'Lookback' period?

Which component in Splunk ES is used to manage the lifecycle of an incident, including status updates and assignments?

You are hunting for evidence of credential dumping. You have access to Sysmon logs. Which EventCode should be the primary focus for detecting memory access to lsass.exe?

When onboarding a new firewall source, you notice that the data is not populating the 'Network Traffic' data model. What is the most efficient first step to troubleshoot the CIM mapping?

How can you ensure that a search field is only treated as a number for calculation purposes?

You want to visualize the geographic origin of incoming connection attempts to identify potentially malicious traffic. Which dashboard is most appropriate?

Which THREE of the following are valid uses of the 'eval' command?

You are mapping incoming alerts to the MITRE ATT&CK framework within the Splunk Enterprise Security (ES) Incident Review dashboard. Which attribute mapping ensures that your TTP-based notable events correctly reflect the adversary behavior?

Which data model does the Risk Analysis adaptive response action typically rely upon to enrich events?

You want to calculate the standard deviation of 'response_time' per 'server'. Which command is correct?

Which THREE diagnostic tools or logs are useful for troubleshooting a malfunctioning correlation search?

Which THREE settings can be configured within the 'Risk Analysis' adaptive response action?

Which Splunk ES dashboard allows you to view and manage active threat intelligence feeds?

You are troubleshooting an 'Adaptive Response' action that is failing to execute on a remote device. What should you check first?

Which TWO of the following are common types of social engineering?

An attacker is using PowerShell to obfuscate their activities. Which data model is most appropriate for searching for encoded PowerShell commands?

You are performing a search and want to ensure the subsearch runs against a specific time range relative to the main search. Which command/option achieves this?

Which THREE elements are essential for a well-defined risk-based alert?

You want to use the 'eval' command to create a new field 'is_critical' that is 'yes' if 'severity' is 'high' or 'critical', and 'no' otherwise. Which syntax is correct?

A correlation search is failing to generate risk events. You check the 'Search Activity' and see that the search is running but returning 0 results. What is the most likely cause?

Which THREE of the following are common phases defined in the Cyber Kill Chain model?

When a notable event is generated, where does the 'Risk Score' value originate?

Which TWO of the following are ways to verify if a file hash is truly malicious within Splunk ES?

During an investigation, you need to group related notables into a single investigation container. Which feature should you use?

Which Splunk ES dashboard allows an analyst to see a summary of all active notable events currently requiring investigation?

A phishing campaign is targeting your organization. Which Splunk ES module is best suited to track the delivery of the malicious email URLs?

Which TWO of the following are examples of reconnaissance techniques used by attackers?

You need to ensure that the 'Threat Intelligence' framework periodically updates. Where do you configure the update interval?

Which THREE techniques can be used in Splunk to reduce the noise of false positives during a threat hunt?

You are conducting a hunt for unauthorized remote access tools. Which Splunk command is most effective for identifying processes that are running from unusual directories (e.g., AppData, Temp)?

Which THREE of the following are valid search operators?

Which TWO ways can you enrich events with threat intelligence in Splunk ES?

You are onboarding a new Windows Event Log source using the Splunk Universal Forwarder. To ensure the data conforms to the Splunk Common Information Model (CIM) for the Authentication data model, where should you primarily configure the sourcetype?

Which search command is used to join threat intelligence data with your local search results?

Which TWO of the following are valid methods to mitigate an insider threat within Splunk ES?

Which THREE of the following represent valid ways to use the 'lookup' command?

Which Splunk feature allows an analyst to save a specific search query, parameterize it with variables, and reuse it across different time ranges and entities?

When calculating a risk score using the 'sum' aggregation method, what happens if multiple risk events for the same object occur within the same time window?

You notice a high volume of traffic from an internal workstation to a non-standard port on an external server. Which search helps identify the frequency of this connection?

You are investigating a potential web-based attack. Which data model contains information regarding HTTP user-agents and request methods?

When using the Splunk Enterprise Security 'Threat Intelligence' framework, which file type is used to import custom STIX/TAXII threat feeds to align with the MITRE ATT&CK framework?

You are investigating a potential data exfiltration event. You have a lookup file called 'authorized_servers.csv' containing a field 'ip_address'. You want to find all connections to IPs not in this list. Which command fulfills this?

You are investigating a suspicious PowerShell script. You suspect the script is using Base64 encoding. Which SPL function can you use to decode the string within Splunk?

What is the primary function of the 'Notable Event Suppression' feature?

You are reviewing a Splunk Enterprise Security alert mapped to the MITRE ATT&CK technique 'T1059.001 (PowerShell)'. Which search command would best identify the use of obfuscated PowerShell commands?

What is the benefit of using the Asset and Identity framework in Splunk ES investigations?

In Splunk ES, where can you manage the 'Risk Threshold' for triggering a Notable Event based on aggregate risk scores?

You are performing a hypothesis-driven hunt and suspect that an attacker is using lateral movement via WMI. Which command in Splunk would best assist in identifying anomalous process creation events associated with WMI (wmiprvse.exe) spawning shells?

Which component in the Splunk ES architecture is responsible for mapping disparate log sources to a unified schema?

Which THREE of the following are recognized components of the NIST Cybersecurity Framework (CSF) Core functions?

You notice that the risk score for an asset is not decaying. Which configuration controls the risk score lifespan?

You are analyzing a data model using tstats. You need to identify rare process executions across your environment. Which command structure provides the most performance-optimized result?

You are troubleshooting a scenario where the 'Risk Notable' is not firing as expected. Which log file should you inspect first to confirm if the Risk Analysis action was successfully triggered?

A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?

When troubleshooting a missing notable event, which search should you run to verify if the correlation search is producing results?

Which component of the Splunk Enterprise Security architecture is responsible for generating notable events?

You need to calculate the average time delta between 'login' and 'logout' events for each user. Which command approach is most effective?

Which TWO actions can be taken on a notable event directly from the Incident Review dashboard?

If an analyst wants to see all risk events associated with a specific IP address, which search command is most effective?

You are auditing your environment against the NIST CSF 'Detect' function. Which TWO of the following Splunk ES features provide the necessary visibility?

You are configuring a new Data Model for use with Splunk Enterprise Security. Which action is required to ensure the data model accelerates correctly for use in notable event generation?

A malware infection is suspected on a host. You notice traffic on port 445. Which Splunk ES correlation search should be prioritized to investigate lateral movement?

In the context of Splunk ES, what is an 'Asset'?

Which TWO of the following are valid methods for enriching notable events in Splunk ES?

Which of the following is considered 'Reconnaissance' in the Cyber Kill Chain?

Which TWO methods can be used to suppress notable events?

Which THREE of the following fields are required for mapping data to the 'Authentication' CIM data model?

An analyst is investigating an incident where a user's risk score spiked significantly. Which investigative tool allows the analyst to see the timeline of all contributing risk events?

An analyst needs to correlate an alert with the 'Delivery' phase of the Cyber Kill Chain. Which data source should be most prioritized for this specific stage?

Which TWO areas of the Splunk ES environment are used to manage risk-based alerting configurations?

You are integrating Splunk with the CIS Benchmarks. Which TWO of the following configurations are necessary to report on 'Secure Configuration' of endpoints?

When investigating a case, where should an analyst document their findings to ensure they are available to other team members?

You want to suppress a specific correlation search alert for a legitimate vulnerability scan. What is the most precise way to achieve this without disabling the search?

You need to modify the default 'Risk Score' logic for a specific asset. Where should this customization occur?

Which THREE commands can be used to handle or create statistical summaries?

A security analyst needs to adjust the weight of a specific risk rule. Where should this configuration be modified?

Which command is used to rename a field in the results table for better readability?

When configuring a correlation search, what does the 'Notable Event' field 'Urgency' determine?

You are troubleshooting why a specific Correlation Search is not appearing in the Incident Review dashboard despite the search returning results. What is the most likely cause?

Which phase of the Cyber Kill Chain is most effectively mitigated by implementing strict egress filtering on your firewall?

Which command allows you to limit the number of fields displayed in your final results table?

A correlation search is failing to generate notable events due to a time-zone mismatch in the source data. What is the best way to handle this in Splunk?

You are configuring a new Risk-Based Alerting (RBA) workflow. Which component is responsible for transforming raw logs into risk notables within the Splunk Enterprise Security app?

You need to append the contents of a lookup file 'threat_intel.csv' to your search results based on the field 'src_ip'. Which command is correct?

Which of the following is a primary benefit of Risk-Based Alerting (RBA) over traditional alerting?

What does the 'OR' operator do in a search?

Which TWO of the following are true regarding the configuration of notable events in Splunk ES?

Which command would you use to filter out events where the 'status' field is 200?

Which THREE attributes are commonly used to filter notable events in the Incident Review dashboard?

You suspect an attacker is using 'living-off-the-land' (LotL) techniques. Which Sysmon event should you analyze to see command-line arguments of suspicious utilities?

When hunting for lateral movement, which THREE data sources are most valuable for correlation?

Which TWO commands are helpful for identifying specific patterns in data?

Where should you perform the initial configuration of the Splunk Common Information Model (CIM) to ensure data is correctly normalized for Enterprise Security?

Which THREE of the following are benefits of using Risk-Based Alerting (RBA) in Splunk ES?

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

Which THREE commands are used to manipulate multi-value fields?

Which THREE of the following are valid ways to filter events based on time?

You are tasked with reporting on 'Lateral Movement' (MITRE ATT&CK) using Splunk ES. Which Data Model must be populated and enabled for this report to function correctly?

Which dashboard provides a summary of all assets categorized by their criticality within the organization?

Your organization is adopting the CIS Controls v8. You are using Splunk to track 'Inventory and Control of Enterprise Assets'. Which Data Model is essential for this visibility?

When using 'stats', how can you include the values of a field as columns in your output?

Which TWO of the following are key components of the Splunk ES Threat Intelligence framework?

You are configuring CIS Benchmarks in Splunk for your Linux environment. Which tool/app is the standard for ingesting and reporting these compliance checks?

An analyst identifies a command-and-control (C2) beaconing pattern. Which search command would be best used to identify the frequency of connections to a specific domain?

Which command is used to append results from one search to another?

When configuring the 'Risk Analysis' adaptive response, what does the 'risk_score' parameter represent?

What is the primary function of the 'Risk Notable' correlation search in Splunk ES?

When dealing with multi-value fields, which command allows you to break them into individual events?

What is the purpose of the 'Incident Review' dashboard in Splunk ES?

Which TWO types of events are typically categorized as 'Notable Events'?

Which command is used to remove duplicate events based on a field?

Which THREE actions are necessary to successfully onboard a new data source into Splunk Enterprise Security?

In the context of the NIST CSF 'Identify' function, which Splunk functionality is most appropriate for maintaining a current list of authorized software?

Which TWO of the following are primary indicators of a phishing attack that you should look for in email logs?

An attacker has modified the registry to ensure persistence. Which Splunk ES data model tracks Windows registry changes?

Which TWO types of data are commonly enriched by the Asset and Identity framework?

Which TWO Splunk features are best for automating the execution of recurring threat hunts?

Which TWO commands are commonly used to remove or limit the results returned by a search?

Which TWO of these commands are used for data visualization prep?

When configuring a risk-based correlation search, what is the primary purpose of the 'Risk Analysis' adaptive response action?

You need to ensure that your Splunk ES environment is properly ingesting threat intelligence data. Where can you confirm that threat sources are active?

You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?

A security analyst needs to reduce the noise generated by a specific correlation search that triggers too frequently for authorized internal vulnerability scanners. What is the most efficient way to handle this in Splunk ES?

Which THREE of the following data models are critical for monitoring lateral movement within a network?

You need to correlate a VPN login with a subsequent file access on an internal server. Which Splunk ES feature helps you link these disparate events?

Which of the following best describes the goal of the 'Exploitation' phase in the Cyber Kill Chain?