A SOC analyst is reviewing login events and wants to identify usernames that appear very infrequently, as these may indicate compromised or shared accounts. Which search would best surface these accounts?

`index=auth | stats count by user`

A security analyst is investigating a network where most traffic is HTTP and HTTPS, but a few unusual protocols appear only a handful of times. The analyst wants to identify which protocols are least frequently seen to focus on potential anomalies. Which search should the analyst run?

`index=network | rare protocol`

`index=network | sort protocol`

`index=network | stats count by protocol`

How are the results of the `rare` command sorted by default?

By count in descending order, with the most common value first

By count in ascending order, with the rarest value first

An analyst runs the search `index=web | rare status_code` and sees the results. Which statement correctly describes the order of the output?

The most common status code appears first, followed by less common ones.

The status codes are sorted by percent in descending order.

The least common status code appears first, followed by more common ones.

The status codes are sorted alphabetically from A to Z.

SplunkCore Certified User

Domain 5Objective 2

The Rare Command SPLK-1001 Practice Questions (Page 2)

Part of the Using Basic Transforming Commands domain, which accounts for 15% of the SPLK-1001 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

7concepts

15%of the exam

Questions 6–10

6foundation · easy
Which search would find the rarest `action` values for each `user`?
Select an answer first
7application · easy
A SOC analyst is reviewing login events and wants to identify usernames that appear very infrequently, as these may indicate compromised or shared accounts. Which search would best surface these accounts?
Select an answer first
8application · easy
A security analyst is investigating a network where most traffic is HTTP and HTTPS, but a few unusual protocols appear only a handful of times. The analyst wants to identify which protocols are least frequently seen to focus on potential anomalies. Which search should the analyst run?
Select an answer first
9foundation · easy
How are the results of the `rare` command sorted by default?
Select an answer first
10application · easy
An analyst runs the search `index=web | rare status_code` and sees the results. Which statement correctly describes the order of the output?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1001” is a trademark of its owner, used for identification only.