Free SPLK-5001 sample questions

Correct answer: False

Splunk Security Essentials (SSE) is a free app that acts as a guide and showcase for security use cases. Its purpose is to help users identify necessary data sources, understand potential detections, and deploy security content. It is a companion and on-ramp to Splunk Enterprise Security (ES), not a replacement for ES, which is the full-featured, premium SIEM solution.

Correct answer: A bot is a single compromised machine running automated malware, while a botnet is a network of these bots controlled by a single attacker.

This is the correct definition. A 'bot' (short for robot) is an individual computer that has been infected with malware allowing it to be controlled remotely. A 'botnet' is the entire collection or network of these compromised bots, which can be commanded simultaneously by an attacker (the 'bot herder') to perform large-scale malicious activities like DDoS attacks or spam campaigns.

Correct answers: To eliminate the concept of a trusted internal network and an untrusted external network.; To enforce strict access control and verify every request as if it originates from an open network.; To grant access based on the principle of least privilege.

This is a core principle of zero trust. It assumes that threats can exist both inside and outside the traditional network perimeter, so no user or device is trusted by default.

The mantra of zero trust is 'never trust, always verify'. Every access request must be authenticated and authorized, regardless of its location on the network.

Zero trust architectures grant users and devices only the minimum level of access necessary to perform their specific tasks, reducing the potential impact of a compromised account or device.

Correct answer: In `props.conf` on the indexers or heavy forwarder responsible for parsing.

Timestamp extraction is a parsing-time activity defined in `props.conf`. An administrator would create a stanza for the specific sourcetype (e.g., `[my_custom_app]`) and use attributes like `TIME_PREFIX`, `TIME_FORMAT`, and `MAX_TIMESTAMP_LOOKAHEAD` to tell Splunk how to correctly identify and parse the timestamp from the raw event data. This configuration needs to be on the parsing tier, which is typically the indexers or a heavy forwarder.

Correct answer: A DoS attack originates from a single source, while a DDoS attack originates from multiple, coordinated sources.

The key differentiator is the number of sources. A Denial of Service (DoS) attack attempts to make a service unavailable by overwhelming it with traffic from a single machine. A Distributed Denial of Service (DDoS) attack uses a network of compromised machines (a botnet) to launch a coordinated attack from many different sources simultaneously, making it much harder to block.

Correct answer: The Asset and Identity Framework

The Asset and Identity Framework is designed specifically for this purpose. It correlates various identifiers (like IP addresses, hostnames, MAC addresses, and user IDs) found in logs with the authoritative information stored in the asset and identity lookups. This allows ES to attribute activity consistently to the correct asset or user, which is fundamental for effective correlation and risk analysis.

Correct answer: It helps map available data sources to specific security use cases and provides pre-built searches to accelerate content development.

Splunk Security Essentials acts as a 'getting started' guide. It allows a team to see what security detections are possible, which data sources are required for those detections, and provides example SPL. This helps teams prioritize data onboarding efforts and quickly demonstrate the value of Splunk for security before or alongside a full ES deployment.

Correct answer: To manipulate people into divulging confidential information or performing actions that compromise security.

Social engineering exploits human psychology rather than technical vulnerabilities. Attackers use techniques like phishing, pretexting, and baiting because it is often easier to trick a person into giving up their credentials, running a malicious file, or granting access than it is to break through multiple layers of technical security controls.

Correct answer: Less-secure elements in an organization's network, such as third-party vendors, software, or hardware.

A supply chain attack compromises an organization by targeting its trusted third-party partners or providers. For example, an attacker might inject malicious code into a software update from a trusted vendor. When the organization installs the update, it unknowingly introduces the malware into its own environment. This allows attackers to bypass the target's direct security controls.

Correct answer: Advanced Persistent Threat (APT)

An Advanced Persistent Threat (APT) is the correct term for a sophisticated, well-funded, and patient threat actor (often a group) that targets specific entities over a long period. Their goals are typically espionage or strategic disruption, and they use advanced techniques to remain undetected.