Splunk SPLK-5001 Online Practice Questions and Exam Preparation

Splunk SPLK-5001 Online Questions & Answers

• Question 1:

  Splunk Enterprise Security has numerous frameworks to create correlations, integrate threat intelligence, and provide a workflow for investigations. Which framework raises the threat profile of individuals or assets to allow identification of people or devices that perform an unusual amount of suspicious activities?

  A. Threat Intelligence Framework
  B. Risk Framework
  C. Notable Event Framework
  D. Asset and Identity Framework
  B. Risk Framework

• Question 2:

  An analyst is building a search to examine Windows XML Event Logs, but the initial search is not returning any extracted fields. Based on the above image, what is themost likelycause?

  

  A. The analyst does not have the proper role to search this data.
  B. The analyst is searching newly indexed data that was improperly parsed.
  C. The analyst did not add the excract command to their search pipeline.
  D. The analyst is not in the Drooer Search Mode and should switch to Smart or Verbose.
  D. The analyst is not in the Drooer Search Mode and should switch to Smart or Verbose.

• Question 3:

  Which Enterprise Security framework provides a mechanism for running preconfigured actions within the Splunk platform or integrating with external applications?

  A. Asset and Identity
  B. Notable Event
  C. Threat Intelligence
  D. Adaptive Response
  D. Adaptive Response

• Question 4:

  There are many resources for assisting with SPL and configuration questions. Which of the following resources feature community-sourced answers?

  A. Splunk Answers
  B. Splunk Lantern
  C. Splunk Guidebook
  D. Splunk Documentation
  A. Splunk Answers

• Question 5:

  An analyst investigates an IDS alert and confirms suspicious traffic to a known malicious IP. What Enterprise Security data model would they use to investigate which process initiated the network connection?

  A. Endpoint
  B. Authentication
  C. Network traffic
  D. Web
  A. Endpoint

• Question 6:

  Upon investigating a report of a web server becoming unavailable, the security analyst finds that the web server's access log has the same log entry millions of times:

  147.186.119.200 - - [28/Jul/2023:12:04:13 -0300] "GET /login/ HTTP/1.0" 200 3733 What kind of attack is occurring?

  A. Denial of Service Attack
  B. Distributed Denial of Service Attack
  C. Cross-Site Scripting Attack
  D. Database Injection Attack
  A. Denial of Service Attack

• Question 7:

  According to Splunk CIM documentation, which field in the Authentication Data Model represents the user who initiated a privilege escalation?

  A. username
  B. src_user_id
  C. src_user
  D. dest_user
  C. src_user

• Question 8:

  What is the main difference between hypothesis-driven and data-driven Threat Hunting?

  A. Data-driven hunts always require more data to search through than hypothesis-driven hunts.
  B. Data-driven hunting tries to uncover activity within an existing data set, hypothesis- driven hunting begins with a potential activity that the hunter thinks may be happening.
  C. Hypothesis-driven hunts are typically executed on newly ingested data sources, while data-driven hunts are not.
  D. Hypothesis-driven hunting tries to uncover activity within an existing data set, data- driven hunting begins with an activity that the hunter thinks may be happening.
  B. Data-driven hunting tries to uncover activity within an existing data set, hypothesis- driven hunting begins with a potential activity that the hunter thinks may be happening.

• Question 9:

  A Cyber Threat Intelligence (CTI) team produces a report detailing a specific threat actor's typical behaviors and intent. This would be an example of what type of intelligence?

  A. Operational
  B. Executive
  C. Tactical
  D. Strategic
  C. Tactical

• Question 10:

  Which of the Enterprise Security frameworks provides additional automatic context and correlation to fields that exist within raw data?

  A. Asset and Identity
  B. Threat Intelligence
  C. Adaptive Response
  D. Risk
  A. Asset and Identity