Define Terms and Aspects of Splunk Enterprise Security and Their Uses Including SPL, Notable Event, Risk Notable, Adaptive Response Action, Risk Object, Contributing Events. SPLK-5001 Practice Questions (Page 5)

Questions 21–23

1. 21foundation · medium

   In a Splunk Enterprise Security workflow, what is the typical sequence of components that leads to an analyst investigating a security incident?

   • AContributing Events → Adaptive Response Action → Notable Event → SPL search
   • BAdaptive Response Action → Notable Event → SPL search → Contributing Events
   • CSPL search → Adaptive Response Action → Notable Event → Contributing Events
   • DSPL search → Notable Event → Contributing Events → Adaptive Response Action
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security operations center (SOC) is overwhelmed by a high volume of low-fidelity alerts. The team wants to reduce noise while ensuring that critical threats are not missed. They plan to use risk-based alerting to aggregate risk scores from multiple sources. However, they are concerned that a single high-risk event might not trigger an alert if the threshold is set too high. Which approach best balances reducing noise and ensuring critical threats are detected?

   • ASet a low risk threshold and use SPL to manually filter out false positives
   • BDisable risk-based alerting and create a Notable Event for every correlation search result
   • CUse a moderate risk threshold and configure Adaptive Response Actions to escalate high-risk events
   • DSet a high risk threshold and rely on manual review of all contributing events
   Reveal Solution Discussion Select an answer first
3. 23foundation · medium

   Which of the following is a common example of an Adaptive Response Action in Splunk Enterprise Security?

   • ARunning a SPL search to investigate the notable event
   • BCreating a new correlation search to detect similar threats
   • CDeleting the notable event from the Incident Review dashboard
   • DBlocking a malicious IP address on a firewall
   Reveal Solution Discussion Select an answer first