Define Terms and Aspects of Splunk Enterprise Security and Their Uses Including SPL, Notable Event, Risk Notable, Adaptive Response Action, Risk Object, Contributing Events. SPLK-5001 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is investigating a Risk Notable that was generated for a user account. The analyst needs to understand which specific activities contributed to the risk score and whether any of those activities were already investigated and closed as false positives. What should the analyst review?

   • AThe Contributing Events of the Risk Notable
   • BThe Adaptive Response Actions taken on the Risk Notable
   • CThe SPL query used in the risk-based alerting rule
   • DThe Risk Object score alone
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team wants to prioritize investigations based on the risk level of assets. They have assigned risk scores to various hosts and users based on their criticality and past incidents. Which ES feature should they use to represent these entities and their risk scores?

   • AAdaptive Response Actions
   • BRisk Objects
   • CContributing Events
   • DNotable Events
   Reveal Solution Discussion Select an answer first
4. 18foundation · medium

   What is an Adaptive Response Action in Splunk Enterprise Security?

   • AA pre-defined set of steps that an analyst must manually follow to respond to a notable event
   • BA dashboard that provides real-time visibility into security operations
   • CAn automated action that can be triggered in response to a notable event, such as blocking an IP or sending an email
   • DA type of correlation search that adapts to changing network conditions
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst needs to create a search that identifies all failed login attempts from a specific IP address and then generates a Notable Event when the count exceeds 10 in an hour. Which tool should the analyst use to write this search?

   • ARisk Objects
   • BSPL (Search Processing Language)
   • CContributing Events
   • DAdaptive Response Actions
   Reveal Solution Discussion Select an answer first
6. 20foundation · medium

   Which of the following best describes the purpose of a Notable Event in security monitoring?

   • ATo automatically remediate security threats without human intervention
   • BTo store all raw logs for compliance and auditing purposes
   • CTo provide a single, actionable item that an analyst can investigate and respond to
   • DTo replace the need for traditional SIEM alerting systems
   Reveal Solution Discussion Select an answer first