Define Long Tail Analysis, Outlier Detection, and Some Common Steps of Hypothesis Hunting with Splunk. SPLK-5001 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is reviewing authentication logs and wants to identify rarely used service accounts that have recently become active, because these could indicate compromised credentials. The analyst needs a Splunk search that surfaces accounts with very few total logon events but that have logged on within the last 24 hours. Which approach best accomplishes this?

   • AFilter for accounts with a username longer than 15 characters and then review the last 24 hours of logons
   • BUse the `rare` command on the last 24 hours of logon events to list accounts with the fewest events
   • CSearch for all logon events in the last 24 hours and sort by account name
   • DCalculate the total count of logon events per account over the past 90 days, then filter to accounts with a count below a threshold that also have an event in the last 24 hours
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A Splunk analyst is hunting for signs of data exfiltration and wants to identify files that are rarely accessed but have recently been copied to external drives. The analyst has a baseline of file access counts over the past year. Which Splunk search strategy best combines long tail analysis and outlier detection to surface these files?

   • ASearch for all copy events in the last 30 days and sort by file size
   • BUse `rare` to list the least accessed files, then manually review each one for recent copy activity
   • CCompute the average access count per file, then use the `outlier` command to flag files with unusually high access counts
   • DFilter for files with a low historical access count, then use `outlier` on the recent copy event counts to flag files with unusually high recent activity
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A threat hunting team wants to proactively identify potential insider threats by looking for employees who access systems they do not normally use. The team plans to use Splunk to analyze access logs. Which of the following best describes the role of hypothesis hunting in this scenario?

   • AIt focuses on known indicators of compromise rather than behavioral anomalies
   • BIt provides a structured process to test the assumption that unusual access patterns indicate insider threat
   • CIt replaces the need for log analysis by using automated alerts
   • DIt is only useful after a security incident has been confirmed
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Splunk analyst is monitoring the number of failed logon attempts per user per day. The analyst wants to flag users whose failed logon count is significantly higher than their own historical average. Which approach is most appropriate?

   • AFor each user, compute the average and standard deviation of failed logons over the past 30 days, then flag days where the count exceeds a threshold based on that distribution
   • BUse the `rare` command to find users with the fewest failed logons
   • CFlag the top 5 users by failed logon count each day
   • DFlag any user with more than 10 failed logons in a day
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst is reviewing VPN login times for a user who typically connects between 8 AM and 6 PM. The analyst notices a login at 2:47 AM and wants to determine if this is truly anomalous. Which approach is most appropriate?

   • ALook at the user's login time for the last 30 days and take the average, then flag any login more than 30 minutes from the average
   • BImmediately disable the user's account because the login time is unusual
   • CCompare the login time to the user's historical login time distribution and flag it if it falls outside the expected range
   • DCheck if the login came from a different IP address and ignore the time if the IP is familiar
   Reveal Solution Discussion Select an answer first