Free SPLK-5001 sample questions

Correct answers: It adds critical context to events, allowing analysts to prioritize alerts based on asset criticality or user privilege level.; It enables Risk-Based Alerting to correlate disparate events to a specific user or system, rather than just an IP or MAC address.

Populated asset and identity lists allow ES to enrich raw events with business context, such as which assets are critical servers or which users are executives. This helps analysts quickly determine the potential impact of an alert.

RBA relies on tracking risk over time for a given entity (risk object). The Asset and Identity framework resolves different identifiers (IP, hostname, MAC, user ID) to a single, consistent asset or identity, allowing risk scores to be aggregated correctly.

Correct answer: src

The Common Information Model (CIM) uses standardized field names to allow correlation across different data sources. For the Network Traffic data model, the standard field for a source IP address is `src`. The destination IP address is `dest`.

Correct answer: False

Splunk Security Essentials (SSE) is a free app that acts as a guide and showcase for security use cases. Its purpose is to help users identify necessary data sources, understand potential detections, and deploy security content. It is a companion and on-ramp to Splunk Enterprise Security (ES), not a replacement for ES, which is the full-featured, premium SIEM solution.

Correct answer: A bot is a single compromised machine running automated malware, while a botnet is a network of these bots controlled by a single attacker.

This is the correct definition. A 'bot' (short for robot) is an individual computer that has been infected with malware allowing it to be controlled remotely. A 'botnet' is the entire collection or network of these compromised bots, which can be commanded simultaneously by an attacker (the 'bot herder') to perform large-scale malicious activities like DDoS attacks or spam campaigns.

Correct answers: To eliminate the concept of a trusted internal network and an untrusted external network.; To enforce strict access control and verify every request as if it originates from an open network.; To grant access based on the principle of least privilege.

This is a core principle of zero trust. It assumes that threats can exist both inside and outside the traditional network perimeter, so no user or device is trusted by default.

The mantra of zero trust is 'never trust, always verify'. Every access request must be authenticated and authorized, regardless of its location on the network.

Zero trust architectures grant users and devices only the minimum level of access necessary to perform their specific tasks, reducing the potential impact of a compromised account or device.

Correct answer: In `props.conf` on the indexers or heavy forwarder responsible for parsing.

Timestamp extraction is a parsing-time activity defined in `props.conf`. An administrator would create a stanza for the specific sourcetype (e.g., `[my_custom_app]`) and use attributes like `TIME_PREFIX`, `TIME_FORMAT`, and `MAX_TIMESTAMP_LOOKAHEAD` to tell Splunk how to correctly identify and parse the timestamp from the raw event data. This configuration needs to be on the parsing tier, which is typically the indexers or a heavy forwarder.

Correct answer: A DoS attack originates from a single source, while a DDoS attack originates from multiple, coordinated sources.

The key differentiator is the number of sources. A Denial of Service (DoS) attack attempts to make a service unavailable by overwhelming it with traffic from a single machine. A Distributed Denial of Service (DDoS) attack uses a network of compromised machines (a botnet) to launch a coordinated attack from many different sources simultaneously, making it much harder to block.

Correct answer: The Asset and Identity Framework

The Asset and Identity Framework is designed specifically for this purpose. It correlates various identifiers (like IP addresses, hostnames, MAC addresses, and user IDs) found in logs with the authoritative information stored in the asset and identity lookups. This allows ES to attribute activity consistently to the correct asset or user, which is fundamental for effective correlation and risk analysis.

Correct answer: It helps map available data sources to specific security use cases and provides pre-built searches to accelerate content development.

Splunk Security Essentials acts as a 'getting started' guide. It allows a team to see what security detections are possible, which data sources are required for those detections, and provides example SPL. This helps teams prioritize data onboarding efforts and quickly demonstrate the value of Splunk for security before or alongside a full ES deployment.

Correct answer: To manipulate people into divulging confidential information or performing actions that compromise security.

Social engineering exploits human psychology rather than technical vulnerabilities. Attackers use techniques like phishing, pretexting, and baiting because it is often easier to trick a person into giving up their credentials, running a malicious file, or granting access than it is to break through multiple layers of technical security controls.