Define Terms and Aspects of Splunk Enterprise Security and Their Uses Including SPL, Notable Event, Risk Notable, Adaptive Response Action, Risk Object, Contributing Events. SPLK-5001 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is designing a workflow to detect and respond to lateral movement. They plan to use a correlation search that identifies multiple failed logins followed by a successful login from a different host. They want to automatically block the source IP and create a Notable Event for investigation. Which combination of features should they use?

   • AAn Adaptive Response Action that runs a script to detect the pattern and block the IP
   • BAn SPL-based correlation search that creates a Notable Event and an Adaptive Response Action to block the IP
   • CA manual SPL query that the analyst runs and then blocks the IP manually
   • DA risk-based alerting rule that assigns a risk score to the user and creates a Risk Notable
   Reveal Solution Discussion Select an answer first
2. 7foundation · medium

   Which of the following is a valid SPL command used to transform search results into a statistical table?

   • Alookup
   • Beval
   • Cwhere
   • Dtable
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst is reviewing a Notable Event and needs to understand why it was triggered. The analyst wants to see the specific log entries that matched the correlation search. What should the analyst look at in the Notable Event details?

   • AThe Adaptive Response Actions
   • BThe Contributing Events
   • CThe Risk Object score
   • DThe SPL query used
   Reveal Solution Discussion Select an answer first
5. 9foundation · medium

   Which of the following is a key characteristic of a Risk Notable?

   • AIt is only generated for users, not for other risk objects
   • BIt is generated when the risk score for a risk object exceeds a defined threshold
   • CIt is always generated by a correlation search
   • DIt is triggered by a single high-risk event
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team wants to prioritize alerts based on the risk that a specific user account poses to the organization. They have configured multiple correlation searches that assign risk scores to this user for various suspicious activities. Which entity in Splunk Enterprise Security represents this user account for risk aggregation?

   • AAn Adaptive Response Action
   • BA Contributing Event
   • CA Risk Object
   • DA Notable Event
   Reveal Solution Discussion Select an answer first