Courseiva

SPLK-5001 · topic practice

Threat Hunting practice questions

Threat Hunting on SPLK-5001 covers hypothesis-driven searches in Splunk Enterprise Security and core Splunk against proxy, DNS, Sysmon, and endpoint data. You are tested on choosing the right SPL commands, statistical functions, and data models to surface beaconing, WMI lateral movement, suspicious process paths, and DNS exfiltration rather than on memorizing static signatures.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member
20 questionsDomain: Threat Hunting
Practice 10 questionsBrowse domain →

What the exam tests

What to know about Threat Hunting

Build and validate SPL searches that aggregate and baseline behavior across proxy, DNS, and Sysmon data. The single most important skill is selecting the correct command and data model to expose anomalies, such as streamstats for beacon intervals or tstats for WMI process creation, instead of relying on static indicators.

Using SPL stats, streamstats, and eventstats to detect periodic beaconing in proxy logs

Applying tstats against Endpoint data models to find anomalous WMI process creation

Filtering Sysmon EventID 1 process creation by Image path under C:\Users\Public

Quantifying DNS exfiltration with subdomain label counts and query length aggregations

Watch out for

Common Threat Hunting exam traps

  • ▸Relying on raw keyword searches instead of statistical baselines, which misses low-and-slow beaconing with jitter
  • ▸Confusing Sysmon event IDs, such as using EventID 3 network connections when process creation EventID 1 is required
  • ▸Ignoring DNS query length or subdomain entropy, so encoded exfiltration blends into normal high-volume DNS traffic

Practice set

Threat Hunting questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice
Read the full Threat Hunting explanation →

You are investigating a potential beaconing pattern. You have identified a suspect destination IP. Which SPL command sequence is most appropriate to calculate the frequency of connections to this IP to validate the beaconing hypothesis?

Question 2mediummultiple choice
Read the full Threat Hunting explanation →

You are hunting for data exfiltration and want to identify large outbound file transfers. Which tool in Splunk is best suited to baseline 'normal' transfer volume per user?

Question 3hardmultiple choice
Read the full Threat Hunting explanation →

You are analyzing a data model using tstats. You need to identify rare process executions across your environment. Which command structure provides the most performance-optimized result?

Question 4hardmultiple choice
Read the full Threat Hunting explanation →

An attacker has cleared the Windows Event Logs to hide their tracks. You are hunting for this activity. Which Event ID in the System log indicates that the log service was stopped or cleared?

Question 5mediummultiple choice
Read the full Threat Hunting explanation →

You are conducting a hunt for unauthorized remote access tools. Which Splunk command is most effective for identifying processes that are running from unusual directories (e.g., AppData, Temp)?

Question 6hardmulti select
Read the full Threat Hunting explanation →

When hunting for lateral movement, which THREE data sources are most valuable for correlation?

Question 7mediummultiple choice
Read the full DNS explanation →

You are a threat hunter investigating potential data exfiltration over DNS. You have Splunk Enterprise Security with the Network_Traffic data model accelerated. You want to find DNS TXT queries where the query length exceeds 100 characters, which may indicate DNS tunneling. Which Splunk search correctly uses tstats to query the Network_Traffic data model?

Question 8mediummultiple choice
Read the full Threat Hunting explanation →

During a threat hunt for beaconing activity, you observe periodic outbound connections to a rare external IP every 60 seconds with small, consistent payloads. You want to quantify how regular these intervals are to distinguish automated C2 from human-driven traffic. Which Splunk command should you use to calculate the standard deviation of the time between connections?

Question 9mediummultiple choice
Read the full Threat Hunting explanation →

You are hunting for anomalous authentication activity across your Windows environment, which ingests Security event logs. You want to find accounts that have authenticated from an unusually high number of distinct source workstations within the last 24 hours, a pattern that may indicate credential misuse or lateral movement. Which Splunk search best identifies these accounts?

Question 10easymultiple choice
Read the full DNS explanation →

You are building a hunt to detect DNS tunneling. You have DNS logs in Splunk with fields query, src, and answer. Which Splunk command is best for identifying hosts that generate an unusually high number of unique DNS queries with long subdomain strings?

Question 11hardmultiple choice
Read the full DNS explanation →

You are conducting a hunt for DNS tunneling, where malware encodes data in DNS queries. Your DNS logs are in the Splunk CIM DNS data model. You want to identify hosts making an unusually high number of DNS queries with long subdomain strings to a single domain within a short window. Which Splunk search using tstats best surfaces this behavior?

Question 12mediummulti select
Read the full Threat Hunting explanation →

You are hunting for signs of data exfiltration over HTTP. You have proxy logs in Splunk with fields src_ip, dest_host, bytes_out, and http_method. Which TWO Splunk search constructs are most effective for identifying potential exfiltration? (Choose two.)

Question 13mediummultiple choice
Read the full DNS explanation →

During a hunt for DNS-based data exfiltration, you want to surface hosts that resolve an unusually high number of unique subdomains under a single parent domain, which may indicate DNS tunneling. Which SPL search best produces this result from your network telemetry?

Question 14mediummulti select
Read the full Threat Hunting explanation →

You are hunting for PowerShell-based attacks and want to identify suspicious command-line arguments that may indicate obfuscation or malicious intent. You have process creation logs in Splunk. Which TWO command-line patterns are most indicative of potentially malicious PowerShell usage? (Choose two.)

Question 15mediummultiple choice
Read the full DNS explanation →

You are hunting for DNS tunneling used by malware to exfiltrate data. You have Splunk ES with the Network_Resolution data model populated. Which search most effectively surfaces hosts generating abnormally high volumes of unique DNS queries with long subdomain strings in a 24-hour window?

Question 16hardmultiple choice
Read the full Threat Hunting explanation →

You are hunting for Kerberoasting activity in your Active Directory environment. You have Windows Security event logs and want to identify accounts that requested Kerberos service tickets (TGS) for multiple distinct service principal names (SPNs) within a short period, which may indicate an attacker enumerating and requesting tickets for offline cracking. Which Splunk search best detects this behavior?

Question 17hardmulti select
Read the full Threat Hunting explanation →

You are hunting for Kerberoasting activity in a Windows environment where Splunk ingests Security event logs and has the Authentication data model populated. Which TWO detection approaches best surface this behavior? (Choose two.)

Question 18mediummultiple choice
Read the full Threat Hunting explanation →

A hunter wants to detect suspicious scheduled task creation on endpoints, using Splunk data from Windows Security Event Code 4698. The hunt should return the task name, the account that created it, and the command the task will run. Which search structure best achieves this?

Question 19hardmultiple choice
Read the full Threat Hunting explanation →

A threat hunter suspects an attacker is using scheduled tasks for persistence. After collecting Windows Task Scheduler operational logs into Splunk, which search best identifies newly created tasks that execute from user-writable directories?

Question 20hardmulti select
Read the full Threat Hunting explanation →

You are hunting for adversaries abusing the Windows Remote Registry service for remote discovery and persistence. Splunk ingests Sysmon Event ID 1 (Process Create) and Windows Security Event ID 4657 (registry value modified). Which TWO Splunk search strategies most directly surface this abuse in your environment? (Choose two.)

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Sign up freeLog in

Focused Threat Hunting sessions

Start a Threat Hunting only practice session

Every question in these sessions is drawn from the Threat Hunting domain — nothing else.

10 questions20 questions30 questions50 questions
Browse all Threat Hunting questions →Mixed SPLK-5001 session

Related practice questions

Related SPLK-5001 topic practice pages

Move into related areas when this topic feels solid.

SIEM Defenses And Data Practices practice questions

SIEM Defenses And Data Practices practice questions for SPLK-5001.

Investigation And Risk Management practice questions

Targeted SPLK-5001 practice covering Investigation And Risk Management.

Threat And Attack Types practice questions

Work through SPLK-5001 questions on Threat And Attack Types.

Threat Hunting practice questions

Sharpen your SPLK-5001 knowledge of Threat Hunting.

SPL Search Proficiency practice questions

Targeted SPLK-5001 practice covering SPL Search Proficiency.

Cyber Landscape And Industry Frameworks practice questions

Cyber Landscape And Industry Frameworks practice questions for SPLK-5001.

SPLK-5001 fundamentals practice questions

Targeted SPLK-5001 practice covering SPLK-5001 fundamentals.

SPLK-5001 scenario practice questions

Sharpen your SPLK-5001 knowledge of SPLK-5001 scenario.

SPLK-5001 troubleshooting practice questions

Practise SPLK-5001 questions linked to SPLK-5001 troubleshooting.

Frequently asked questions

What does the SPLK-5001 exam test about Threat Hunting?
Build and validate SPL searches that aggregate and baseline behavior across proxy, DNS, and Sysmon data. The single most important skill is selecting the correct command and data model to expose anomalies, such as streamstats for beacon intervals or tstats for WMI process creation, instead of relying on static indicators.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Threat Hunting questions in a focused session?
Yes — the session launcher on this page draws every question from the Threat Hunting domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other SPLK-5001 topics?
Use the topic links above to move to related areas, or go back to the SPLK-5001 question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the SPLK-5001 exam covers. They are not copied from any real exam or dump site.