Splunk Cybersecurity Defense Analyst (SPLK-5001) Certification Sample Questions

02. Searching the Network Traffic data model, an analyst sees that on some events src holds an IP address while on others it holds a hostname. A colleague says this means the normalization for one of the sources is broken. What is the accurate reading?
a) The mixed values mean the two sources cannot be searched together and must be handled by separate correlation searches
b) The colleague is right: src must always hold an IP address, so events carrying a hostname come from a source that is not normalized
c) src is the source in whatever form the source knows it, and separate address and hostname fields exist
d) The hostname values were added by the asset lookup, replacing the original address

03. While developing a search an analyst runs index=security | head 100 | table _time, user, action before running it over the full time range. Why is that a sensible development practice?
a) Duplicate events are removed before table renders them, so each user appears on a single row while the search is being checked
b) Only the first hundred results are processed, so the fields and the layout can be checked without loading the whole index
c) table cannot render an unbounded result set, so a limit must precede it in every search that uses it
d) Dispatching to fewer indexers leaves the rest of the cluster free, so other analysts' searches are not delayed while this one is being drafted

04. Reading the configuration of a correlation search, an analyst finds that creating the notable event is itself listed among the search's adaptive response actions, alongside an action that sends an email. What does that tell the analyst about how correlation searches produce notables?
a) The email action creates the notable, and the search would raise nothing without it
b) Notable creation is an adaptive response action that only an analyst can trigger from the notable
c) The listing is a display quirk, and notable creation is a fixed behavior of every correlation search that cannot be removed
d) A notable is one of the response actions a search may take on a match, configured like any other

05. A correlation search runs every five minutes over the preceding five minutes of a cloud provider's audit source. The source is onboarded and complete, and searching it by hand always finds the events the search should match, yet the search rarely raises anything. Comparing timestamps, the analyst finds that each event was indexed about fifteen minutes after its own timestamp. The provider's clock has been checked and is accurate.
What is happening?
a) The search's throttling suppresses the notables because the same events are matched on every run
b) The audit source is not normalized to the model the search reads, so the fields the search filters on are empty
c) The events arrive about fifteen minutes late, so the window covering their timestamps has already been searched
d) The provider's clock is fifteen minutes ahead, so the events are timestamped in the future and fall outside every search window

06. Every morning, the entities at the top of the Risk Analysis dashboard are the organization's domain controllers and payment servers. The organization's risk framework is configured to weight risk contributions by asset priority. Investigating each day, analysts find the contributing events are routine administrative activity.
What best explains why those hosts keep rising to the top?
a) The hosts are compromised, since risk only accumulates on entities involved in malicious activity
b) High asset priority can raise the risk each event contributes, so routine activity on critical hosts accumulates quickly
c) The dashboard sorts entities by name, and those hosts happen to sort first
d) Risk from all hosts in the estate is attributed to the domain controllers because they authenticate every sign-in

07. Sign-in events from the VPN carry the account as an email address, while events from the domain controllers carry it as a short account name. On notable events for either, the asset and identity framework shows the same person's name, department and manager. What makes that possible?
a) The VPN add-on rewrites the email address into the short account name before indexing
b) The framework matches on the person's name field, which both sources populate
c) An analyst has manually linked the two accounts on a previous notable
d) The identity record lists several identifiers for each person

08. An analyst has a list of four thousand known-bad IP addresses from an intelligence report and wants to find any connection event to any of them over the last month. A first attempt writes every address into the base search joined by OR. The list will be refreshed every week and reused in several searches. What is the better approach?
a) Keep the OR chain but move it after the base search into a where clause
b) Split the search into forty runs of one hundred addresses each and combine the results by hand
c) Load the addresses into a lookup table and match events against it with lookup
d) Search for the addresses' network ranges instead, using a wildcard on the first two octets

09. Three months after a notable event was raised, an analyst reopens it during a related investigation. The notable is still on record with all its fields, but opening the events behind it returns nothing. What is the most likely reason?
a) The source events aged out of their index, while the notable was kept longer
b) The correlation search that raised it has since been disabled
c) The data model the search read has been rebuilt, which removed the events
d) Closing the notable deleted the events it referenced

10. On premises, the SOC reads the Windows Security event log to see administrator sign-ins to servers. The organization is now moving its administration to a cloud tenant, where administrators sign in through the cloud identity provider and manage resources through the provider's console.
Which cloud source is the equivalent for seeing those administrative sign-ins?
a) The operating system logs of the cloud virtual machines, which record sign-ins as they did on premises
b) The virtual network flow logs, which record the connections administrators make to cloud resources
c) The cloud provider's billing records, which show which administrator created each resource
d) The cloud identity provider's sign-in log, which records each authentication to the tenant