Define Terms and Aspects of Splunk Enterprise Security and Their Uses Including SPL, Notable Event, Risk Notable, Adaptive Response Action, Risk Object, Contributing Events. SPLK-5001 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   What is a Notable Event in Splunk Enterprise Security?

   • AA dashboard that displays the top security threats in the environment
   • BA raw log entry that indicates a potential security issue
   • CA type of SPL search that is used to detect anomalies in network traffic
   • DA security finding that is generated by correlation searches and requires investigation by an analyst
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During a security incident, an analyst wants to automatically quarantine a compromised endpoint and add a threat intelligence entry to a blocklist as soon as a Notable Event is created. Which Splunk Enterprise Security feature should the analyst configure to execute these actions?

   • AA risk-based alerting rule that assigns a risk score
   • BAn Adaptive Response Action attached to the Notable Event
   • CA Contributing Event search that collects endpoint logs
   • DA correlation search that runs every 5 minutes
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A correlation search detects a potential malware infection on a host. The security team wants to automatically isolate the host from the network and send a notification to the incident response team. What should the team configure in Splunk Enterprise Security to achieve this?

   • AA Notable Event with an Adaptive Response Action
   • BA Contributing Event with a tag
   • CA Risk Object with a high risk score
   • DAn SPL query that runs manually
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization wants to reduce alert fatigue by only alerting when a user's cumulative risk score from multiple low-level activities exceeds a threshold. Which approach should the analyst take?

   • ACreate a standard Notable Event for each low-level activity
   • BUse an Adaptive Response Action to suppress all low-level alerts
   • CManually review all contributing events and create a Notable Event for each
   • DConfigure a risk-based alerting rule that generates a Risk Notable when the risk score threshold is met
   Reveal Solution Discussion Select an answer first
6. 5foundation · medium

   In Splunk Enterprise Security, what is the primary purpose of Search Processing Language (SPL)?

   • ATo manage the installation and deployment of Splunk apps and add-ons
   • BTo define the structure of the data model used by Enterprise Security
   • CTo configure the authentication and authorization settings for Splunk users
   • DTo query and analyze data in Splunk, enabling the creation of searches, reports, and alerts
   Reveal Solution Discussion Select an answer first