How are Notable Events configured in Splunk Enterprise Security?

Via an Adaptive Response Action in a correlation search.

Via an Adaptive Response Action in a regular search.

Via an Adaptive Response Action in a correlation search.

Which of the following is a best practice when creating performant searches within Splunk?

Utilize specific fields to return only the data that is required.

Utilize the transaction command to aggregate data for faster analysis.

Utilize Aggregating commands to ensure all data is available prior to Streaming commands.

Utilize specific fields to return only the data that is required.

Utilize multiple wildcards across fields to ensure returned data is complete and available.

The eval SPL expression supports many types of functions. Which of these function categories is not valid with eval?

Comparison and Conditional functions

When threat hunting for outliers in Splunk, which of the following SPL pipelines would filter for users with over a thousand occurrences?

| stats count by user | where count > 1000 | sort - count

| sort by user | where count > 1000

| stats count by user | where count > 1000 | sort - count

| stats count(user) | sort - count | where count > 1000

An analyst is investigating the number of failed login attempts by IP address. Which SPL command can be used to create a temporary table containing the number of failed login attempts by IP address over a specific time period?

index=security_logs eventtype=failed_login | stats count as failed_attempts by src_ip | sort -failed_attempts

index=security_logs eventtype=failed_login | eval count as failed_attempts by src_ip | sort -failed_attempts

index=security_logs eventtype=failed_login | transaction count as failed_attempts by src_ip | sort -failed_attempts

index=security_logs eventtype=failed_login | stats count as failed_attempts by src_ip | sort -failed_attempts

index=security_logs eventtype=failed_login | sum count as failed_attempts by src_ip | sort -failed_attempts

Which of the following is the primary benefit of using the CIM in Splunk?

It allows for easier correlation of data from different sources.

It improves the performance of search queries on raw data.

It enables the use of advanced machine learning algorithms.

It automatically detects and blocks cyber threats.

Which of the following use cases is best suited to be a Splunk SOAR Playbook?

Taking containment action on a compromised host

Forming hypothesis for Threat Hunting

Creating persistent field extractions.

Taking containment action on a compromised host

Which of the following is not considered an Indicator of Compromise (IOC)?

A specific password for a compromised account.

A specific domain that is utilized for phishing.

A specific IP address used in a cyberattack.

A specific file hash of a malicious executable.

A specific password for a compromised account.

An analyst is attempting to investigate a Notable Event within Enterprise Security. Through the course of their investigation they determined that the logs and artifacts needed to investigate the alert are not available.What event disposition should the analyst assign to the Notable Event?

Other, since a security engineer needs to ingest the required logs.

Benign Positive, since there was no evidence that the event actually occurred.

False Negative, since there are no logs to prove the activity actually occurred.

True Positive, since there are no logs to prove that the event did not occur.

Other, since a security engineer needs to ingest the required logs.

A threat hunter executed a hunt based on the following hypothesis:As an actor, I want to plant rundll32 for proxy execution of malicious code and leverage Cobalt Strike for Command and Control.Relevant logs and artifacts such as Sysmon, netflow, IDS alerts, and EDR logs were searched, and the hunter is confident in the conclusion that Cobalt Strike is not present in the company's environment.Which of the following best describes the outcome of this threat hunt?

The threat hunt was successful in providing strong evidence that the tactic and tool is not present in the environment.

The threat hunt was successful because the hypothesis was not proven.

The threat hunt failed because the hypothesis was not proven.

The threat hunt failed because no malicious activity was identified.

The threat hunt was successful in providing strong evidence that the tactic and tool is not present in the environment.

During their shift, an analyst receives an alert about an executable being run from C:\Windows\Temp. Why should this be investigated further?

Temp directories are world writable thus allowing attackers a place to drop, stage, and execute malware on a system without needing to worry about file permissions.

Temp directories aren't owned by any particular user, making it difficult to track the process owner when files are executed.

Temp directories are flagged as non-executable, meaning that no files stored within can be executed, and this executable was run from that directory.

Temp directories contain the system page file and the virtual memory file, meaning the attacker can use their malware to read the in memory values of running programs.

Temp directories are world writable thus allowing attackers a place to drop, stage, and execute malware on a system without needing to worry about file permissions.

An analyst would like to visualize threat objects across their environment and chronological risk events for a Risk Object in Incident Review. Where would they find this?

Clicking the risk event count to open the Risk Event Timeline.

Running the Risk Analysis Adaptive Response action within the Notable Event.

Via a workflow action for the Risk Investigation dashboard.

Via the Risk Analysis dashboard under the Security Intelligence tab in Enterprise Security.

Clicking the risk event count to open the Risk Event Timeline.

A Risk Rule generates events on Suspicious Cloud Share Activity and regularly contributes to confirmed incidents from Risk Notables. An analyst realizes the raw logs these events are generated from contain information which helps them determine what might be malicious.What should they ask their engineer for to make their analysis easier?

Create a field extraction for this information.

Add this information to the risk message.

Create another detection for this information.

Allowlist more events based on this information.

What device typically sits at a network perimeter to detect command and control and other potentially suspicious traffic?

Endpoint Detection and Response

Upon investigating a report of a web server becoming unavailable, the security analyst finds that the web server's access log has the same log entry millions of times:147.186.119.200 - - [28/Jul/2023:12:04:13 -0300] 'GET /login/ HTTP/1.0' 200 3733What kind of attack is occurring?

Distributed Denial of Service Attack

A Risk Notable Event has been triggered in Splunk Enterprise Security, an analyst investigates the alert, and determines it is a false positive. What metric would be used to define the time between alert creation and close of the event?

MTBF (Mean Time Between Failures)

MTTA (Mean Time to Acknowledge)

Which of the following is considered Personal Data under GDPR?

An individual's address including their first and last name.

The birth date of an unidentified user.

An individual's address including their first and last name.

The name of a deceased individual.

A company's registration number.

Splunk SPLK-5001 Practice Test 1 - Free Online Exam Prep & Questions

When searching in Splunk, which of the following SPL commands can be used to run a subsearch across every field in a wildcard field list?

foreach

rex

makeresults

transaction

Comment (0)

Splunk SPLK-5001 Practice Test 1

Question

Splunk SPLK-5001 Practice Tests

Practice Tests