An analyst has completed an investigation of a notable event in Splunk ES and has determined it is a True Positive. The analyst wants to record this disposition so it is reflected in the event's metadata and available for reporting. What must the analyst do to assign the disposition?

Add a comment to the event with the disposition text

Create a new notable event with the disposition in the title

Use the 'Edit' action on the notable event and select the disposition from the dropdown

Edit the correlation search to suppress the event

A Splunk ES analyst is reviewing a notable event and sees that the disposition is set to 'False Positive.' What does this disposition indicate about the investigation outcome?

The investigation was inconclusive and needs more data

The detection logic or data caused the alert to fire incorrectly

The alert fired correctly but the activity was harmless

The activity was confirmed malicious and required remediation

SplunkCertified Cybersecurity Defense Analyst

Domain 4Objective 3

Demonstrate Ability to Recognize Common Event Dispositions and Correctly Assign Them. SPLK-5001 Practice Questions (Page 2)

Part of the Investigation, Event Handling, Correlation, and Risk domain, which accounts for 20% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 11 practice questions to prepare you well beyond it. (estimate)

11questions here

3free pages

3concepts

20%of the exam

Questions 6–10

6application · medium
An analyst has completed an investigation of a notable event in Splunk ES and has determined it is a True Positive. The analyst wants to record this disposition so it is reflected in the event's metadata and available for reporting. What must the analyst do to assign the disposition?
Select an answer first
7application · easy
A Splunk ES analyst is reviewing a notable event and sees that the disposition is set to 'False Positive.' What does this disposition indicate about the investigation outcome?
Select an answer first
8foundation · easy
In Splunk ES, which field is used to record the disposition of an event when an analyst updates it?
Select an answer first
9application · medium
A SOC analyst investigates an alert for 'Malware Detected' on an endpoint. The analyst reviews the endpoint logs and confirms that a known malicious executable was executed, and it has established persistence via a scheduled task. The analyst quarantines the file and removes the scheduled task. Which disposition should be assigned?
Select an answer first
10foundation · easy
An analyst investigates an alert triggered by a user downloading a file from a known malicious URL. The investigation reveals the file was actually a legitimate software update hosted on a compromised domain. Which disposition should the analyst assign?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.

Demonstrate Ability to Recognize Common Event Dispositions and Correctly Assign Them. SPLK-5001 Practice Questions (Page 2)

Questions 6–10

An analyst has completed an investigation of a notable event in Splunk ES and has determined it is a True Positive. The analyst wants to record this disposition so it is reflected in the event's metadata and available for reporting. What must the analyst do to assign the disposition?

A Splunk ES analyst is reviewing a notable event and sees that the disposition is set to 'False Positive.' What does this disposition indicate about the investigation outcome?

In Splunk ES, which field is used to record the disposition of an event when an analyst updates it?

An analyst investigates an alert triggered by a user downloading a file from a known malicious URL. The investigation reveals the file was actually a legitimate software update hosted on a compromised domain. Which disposition should the analyst assign?

Keep studying — Investigation, Event Handling, Correlation, and Risk