SPLK-5002 sample questions

Question 1

A Defense Engineer needs to implement a Risk-Based Alerting (RBA) strategy. They want to assign risk scores to users based on observed suspicious behaviors without triggering an immediate alert for every single event.

Which type of correlation search should be configured to accomplish this?

Accepted Answer

A correlation search with a 'Risk Analysis' adaptive response action that creates a risk modifier.

Answer

A real-time search that triggers a 'Send to SOAR' action.

Answer

A correlation search creating a Notable Event with a severity of 'Informational'.

Answer

A scheduled report that emails the SOC manager daily summaries.

Question 2

Review the following Mermaid diagram representing a Risk-Based Alerting (RBA) workflow:

```mermaid
flowchart LR
A[Raw Events] --> B{Correlation Search}
B -->|Match| C[Risk Analysis Action]
C --> D[Risk Index]
D --> E{Risk Incident Rule}
E -->|Threshold Met| F[Notable Event]
```

At which stage in this workflow are 'Risk Modifiers' applied to the Risk Object?

Accepted Answer

Stage C

Answer

Stage E

Answer

Stage B

Answer

Stage F

Question 3

A Splunk SOAR engineer is designing a playbook to handle phishing investigations. The playbook needs to extract all URLs from the email body and then check each URL against a reputation service.

Which two playbook blocks are essential to achieve this workflow? (Select TWO)

Accepted Answer

Action Block

Accepted Answer

Utility Block

Answer

Prompt Block

Answer

Manual Task Block

Question 4

When integrating Splunk Enterprise Security (ES) with Splunk SOAR, an administrator wants to ensure that when a Notable Event's status is changed to 'Closed' in ES, the corresponding container in SOAR is also closed automatically.

Which feature must be configured to enable this synchronization?

Accepted Answer

Phantom App for Splunk (Bidirectional Sync)

Answer

CIM Compliance

Answer

Notable Event Correlation

Answer

Adaptive Response Actions

Question 5

A detection engineer is reviewing the efficacy of a specific correlation search. They notice that the search generates a high volume of alerts for a specific administrative subnet (10.10.5.0/24) performing legitimate scanning activities.

What is the most effective way to suppress these specific alerts without disabling the detection for the rest of the network?

Accepted Answer

Create a managed lookup file containing the subnet and configure the correlation search to filter against this lookup (Whitelisting).

Answer

Increase the throttling window for the correlation search.

Answer

Add `NOT src_ip=10.10.5.0/24` directly to the base search SPL.

Answer

Delete the notable events from the KVStore manually.

Question 6

True or False: In Splunk Enterprise Security, the Asset and Identity frameworks can automatically enrich notable events with departmental information, but they cannot effectively prioritize alerts based on the 'criticality' field of an asset.

Accepted Answer

False

Answer

True

Question 7

A security manager requires a monthly report detailing the 'Mean Time to Detect' (MTTD) and 'Mean Time to Respond' (MTTR) for the SOC.

Which Splunk Enterprise Security dashboard provides these metrics out-of-the-box?

Accepted Answer

SOC Operations (or Incident Review Operations)

Answer

Risk Analysis

Answer

Threat Activity

Answer

Security Posture

Question 8

You are creating a new correlation search to detect 'Brute Force Access' attempts. You want to ensure that if the search runs every 5 minutes and detects an attack, it creates a Notable Event, but does NOT create another duplicate event for the same user and destination for at least 1 hour.

Which configuration setting handles this requirement?

Accepted Answer

Window Throttling

Answer

Adaptive Response Frequency

Answer

Schedule Priority

Answer

Window Duration

Question 9

Case Study: GlobalFinance Corp

GlobalFinance Corp has a distributed Splunk environment. They are implementing a Threat Intelligence program. They have three requirements:
1. Ingest a paid STIX/TAXII feed from 'VendorX'.
2. Automatically verify if any internal IP addresses have communicated with malicious IPs from this feed in the last 24 hours.
3. If a match is found, raise a 'Critical' Notable Event.

The engineer has configured the Threat Intelligence Download in Enterprise Security to fetch the feed.

What is the next logical step to automate the detection of historical matches (Requirement 2)?

Accepted Answer

Enable the 'Threat - Threat List Activity - Rule' correlation search.

Answer

Create a new Data Model for 'Threat Intel' and accelerate it.

Answer

Write a Python script to query the TAXII server and grep the local firewall logs.

Answer

Manually run a `stats` command against the `index=main` and lookup the threat table.

Question 10

When mapping a detection to the MITRE ATT&CK framework within Splunk Enterprise Security, which field is primarily used to link the correlation search to a specific Technique ID (e.g., T1059)?

Accepted Answer

The 'Annotations' field (mitre_attack).

Answer

The 'Next Steps' field.

Answer

The 'Drilldown Name' field.

Answer

The 'Notable Event Description' field.

Free SPLK-5002 sample questions

A Defense Engineer needs to implement a Risk-Based Alerting (RBA) strategy. They want to assign risk scores to users based on observed suspicious behaviors without triggering an immediate alert for every single event. Which type of correlation search should be configured to accomplish this?

A Splunk SOAR engineer is designing a playbook to handle phishing investigations. The playbook needs to extract all URLs from the email body and then check each URL against a reputation service. Which two playbook blocks are essential to achieve this workflow? (Select TWO)

When integrating Splunk Enterprise Security (ES) with Splunk SOAR, an administrator wants to ensure that when a Notable Event's status is changed to 'Closed' in ES, the corresponding container in SOAR is also closed automatically. Which feature must be configured to enable this synchronization?

True or False: In Splunk Enterprise Security, the Asset and Identity frameworks can automatically enrich notable events with departmental information, but they cannot effectively prioritize alerts based on the 'criticality' field of an asset.

A security manager requires a monthly report detailing the 'Mean Time to Detect' (MTTD) and 'Mean Time to Respond' (MTTR) for the SOC. Which Splunk Enterprise Security dashboard provides these metrics out-of-the-box?

When mapping a detection to the MITRE ATT&CK framework within Splunk Enterprise Security, which field is primarily used to link the correlation search to a specific Technique ID (e.g., T1059)?

10 more free samples are waiting