Define Terms and Aspects of Splunk Enterprise Security and Their Uses Including SPL, Notable Event, Risk Notable, Adaptive Response Action, Risk Object, Contributing Events. SPLK-5001 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · medium

   What is a Risk Object in Splunk Enterprise Security?

   • AA type of notable event that has a high risk score
   • BAn entity, such as a user or device, that is assigned a risk score based on its activity
   • CA dashboard that displays the top risks in the environment
   • DA correlation search that identifies risky behavior
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is investigating a Notable Event that was generated from a correlation search. The analyst needs to see the raw log entries that triggered the alert to understand the sequence of events. What should the analyst review?

   • AThe Adaptive Response Actions taken on the Notable Event
   • BThe Risk Object associated with the Notable Event
   • CThe SPL query used in the correlation search
   • DThe Contributing Events of the Notable Event
   Reveal Solution Discussion Select an answer first
4. 13foundation · medium

   What are Contributing Events in the context of a Notable Event?

   • AThe actions taken in response to the Notable Event
   • BThe raw log events that were used to generate the Notable Event
   • CThe list of analysts who have investigated the Notable Event
   • DThe risk scores associated with the Notable Event
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst notices that a user account has triggered multiple low-severity alerts over the past week, each individually below the threshold for a Notable Event. The analyst wants to create a single alert that fires only when the cumulative risk score for that user exceeds a threshold. Which type of event should the analyst configure?

   • AA Risk Notable generated from a risk-based alerting rule
   • BA standard Notable Event triggered by a correlation search
   • CA Contributing Event that groups all low-severity alerts
   • DAn Adaptive Response Action that runs on every alert
   Reveal Solution Discussion Select an answer first
6. 15foundation · medium

   What is the role of a Risk Object in risk-based alerting?

   • ATo store raw logs for forensic analysis
   • BTo act as the entity that accumulates risk scores from various risk events
   • CTo provide a list of all security incidents in the environment
   • DTo define the threshold for when a notable event is generated
   Reveal Solution Discussion Select an answer first