How should I use these Threat And Attack Types practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Threat And Attack Types questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Threat And Attack Types domain.

SPLK-5001 · topic practice

Threat And Attack Types practice questions

Practise Splunk Certified Cybersecurity Defense Analyst (SPLK-5001) (SPLK-5001) Threat And Attack Types practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Threat And Attack Types

Practice 10 questions Browse domain →

What the exam tests

What to know about Threat And Attack Types

Threat And Attack Types questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Threat And Attack Types exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Threat And Attack Types questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Threat And Attack Types explanation →

A user reports receiving a suspicious email containing an attachment. Which Splunk ES feature allows you to quickly search for this file hash across your environment?

Trap 1: Dashboard > File Intelligence

This is not a default ES dashboard name.

Trap 2: Incident Review > Search by Hash

This is a manual workflow, not a built-in feature path.

Trap 3: Search > File Hash Investigation

This is not a native ES menu path.

Study all Threat And Attack Types common traps →

A
Enterprise Security Search bar
The primary search bar allows for immediate global searching of hashes.
B
Dashboard > File Intelligence
Why wrong: This is not a default ES dashboard name.
C
Incident Review > Search by Hash
Why wrong: This is a manual workflow, not a built-in feature path.
D
Search > File Hash Investigation
Why wrong: This is not a native ES menu path.

Threat And Attack Types practice questions

What to know about Threat And Attack Types

Common Threat And Attack Types exam traps

Threat And Attack Types questions

A user reports receiving a suspicious email containing an attachment. Which Splunk ES feature allows you to quickly search for this file hash across your environment?

You are investigating a potential insider threat involving unauthorized data exfiltration. Which Splunk ES feature allows you to correlate multiple events occurring over a long duration to a single entity?

A SOC analyst observes an unusual spike in failed login attempts followed by a successful login from a new IP address. Which Splunk Enterprise Security dashboard should the analyst check to confirm if this is a potential brute-force attack?

A phishing campaign is targeting your organization. Which Splunk ES module is best suited to track the delivery of the malicious email URLs?

You need to verify if an external IP address is a known malicious TOR exit node. Which Splunk ES feature should you use?

An analyst wants to investigate a suspicious email attachment. Which Splunk ES notable event field is most effective for pivoting to the 'File' domain investigation dashboard?

You are auditing logs and find that a user has modified an audit policy using 'auditpol.exe'. Which Splunk CIM data model should contain this information?

A malware infection is suspected on a host. You notice traffic on port 445. Which Splunk ES correlation search should be prioritized to investigate lateral movement?

An analyst identifies a command-and-control (C2) beaconing pattern. Which search command would be best used to identify the frequency of connections to a specific domain?

You are investigating a user who has triggered multiple high-risk alerts. Where in Splunk ES can you view the historical risk score progression for this specific user?

Which Splunk ES dashboard allows an analyst to see a summary of all active notable events currently requiring investigation?

You need to ensure that your Splunk ES environment is properly ingesting threat intelligence data. Where can you confirm that threat sources are active?

An attacker has cleared the Windows Security Event log to hide their tracks. Which data model can detect this action?

You notice a system process attempting to connect to a suspicious external domain. Which CIM data model would contain this network connection information?

An attacker is using PowerShell to obfuscate their activities. Which data model is most appropriate for searching for encoded PowerShell commands?

An attacker is attempting to use a 'Pass-the-Hash' technique. Which authentication log event code in Windows (Event ID 4624) should you look for to detect this?

What is the primary function of the 'Incident Review' dashboard in Splunk ES?

Which Splunk ES component would you use to define a new correlation rule based on a custom blacklist of domains?

You are investigating a potential web-based attack. Which data model contains information regarding HTTP user-agents and request methods?

An attacker is using a technique to hide in plain sight by renaming a common system process. Which data model is most suitable for comparing process names against known good paths?

Track your progress over time

Start a Threat And Attack Types only practice session

Related SPLK-5001 topic practice pages

Investigation And Risk Management practice questions

SIEM Defenses And Data Practices practice questions

Threat And Attack Types practice questions

Threat Hunting practice questions

Cyber Landscape And Industry Frameworks practice questions

SPL Search Proficiency practice questions

SPLK-5001 fundamentals practice questions

SPLK-5001 scenario practice questions

SPLK-5001 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid