Splunk SPLK-5001 Online Practice Questions and Exam Preparation

Splunk SPLK-5001 Online Questions & Answers

• Question 11:

  Which field is automatically added to search results when assets are properly defined and enabled in Splunk Enterprise Security?

  A. asset_category
  B. src_ip
  C. src_category
  D. user
  C. src_category

• Question 12:

  Which search command allows an analyst to match whatever is inside the parentheses as a single term in the index, even if it contains characters that are usually recognized as minor breakers such as periods or underscores?

  A. CASE()
  B. LIKE()
  C. FORMAT ()
  D. TERM ()
  D. TERM ()

• Question 13:

  An analyst is looking at Web Server logs, and sees the following entry as the last web request that a server processed before unexpectedly shutting down:

  147.186.119.107 - - [28/Jul/2006:10:27:10 -0300] "POST /cgi-bin/shutdown/ HTTP/1.0" 200 What kind of attack is most likely occurring?

  A. Distributed denial of service attack.
  B. Denial of service attack.
  C. Database injection attack.
  D. Cross-Site scripting attack.
  B. Denial of service attack.

• Question 14:

  An analyst is investigating the number of failed login attempts by IP address. Which SPL command can be used to create a temporary table containing the number of failed login attempts by IP address over a specific time period?

  A. index=security_logs eventtype=failed_login | eval count as failed_attempts by src_ip | sort -failed_attempts
  B. index=security_logs eventtype=failed_login | transaction count as failed_attempts by src_ip | sort -failed_attempts
  C. index=security_logs eventtype=failed_login | stats count as failed_attempts by src_ip | sort -failed_attempts
  D. index=security_logs eventtype=failed_login | sum count as failed_attempts by src_ip | sort -failed_attempts
  C. index=security_logs eventtype=failed_login | stats count as failed_attempts by src_ip | sort -failed_attempts

• Question 15:

  What device typically sits at a network perimeter to detect command and control and other potentially suspicious traffic?

  A. Host-based firewall
  B. Web proxy
  C. Endpoint Detection and Response
  D. Intrusion Detection System
  D. Intrusion Detection System

• Question 16:

  How are Notable Events configured in Splunk Enterprise Security?

  A. During an investigation.
  B. As part of an audit.
  C. Via an Adaptive Response Action in a regular search.
  D. Via an Adaptive Response Action in a correlation search.
  D. Via an Adaptive Response Action in a correlation search.

• Question 17:

  During their shift, an analyst receives an alert about an executable being run from C:\Windows\Temp. Why should this be investigated further?

  A. Temp directories aren't owned by any particular user, making it difficult to track the process owner when files are executed.
  B. Temp directories are flagged as non-executable, meaning that no files stored within can be executed, and this executable was run from that directory.
  C. Temp directories contain the system page file and the virtual memory file, meaning the attacker can use their malware to read the in memory values of running programs.
  D. Temp directories are world writable thus allowing attackers a place to drop, stage, and execute malware on a system without needing to worry about file permissions.
  D. Temp directories are world writable thus allowing attackers a place to drop, stage, and execute malware on a system without needing to worry about file permissions.

• Question 18:

  Which of the following is a correct Splunk search that will return results in the most performant way?

  A. index=foo host=i-478619733 | stats range(_time) as duration by src_ip | bin duration span=5min | stats count by duration, host
  B. | stats range(_time) as duration by src_ip | index=foo host=i-478619733 | bin duration span=5min | stats count by duration, host
  C. index=foo host=i-478619733 | transaction src_ip |stats count by host
  D. index=foo | transaction src_ip |stats count by host | search host=i-478619733
  A. index=foo host=i-478619733 | stats range(_time) as duration by src_ip | bin duration span=5min | stats count by duration, host

• Question 19:

  Which of the following is a tactic used by attackers, rather than a technique?

  A. Gathering information about a target.
  B. Establishing persistence with a scheduled task.
  C. Using a phishing email to gain initial access.
  D. Escalatingprivileges via UAC bypass.
  A. Gathering information about a target.

• Question 20:

  Which pre-packaged app delivers security content and detections on a regular, ongoing basis for Enterprise Security and SOAR?

  A. SSE
  B. ESCU
  C. Threat Hunting
  D. InfoSec
  B. ESCU