Describe SIEM Best Practices and Basic Operation Concepts of Splunk Enterprise Security, Including the Interaction Between CIM, Data Models and Acceleration, Asset and Identity Frameworks, and Common CIM Fields That May Be Used in Investigations. SPLK-5001 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A SOC manager is reviewing the SIEM's alerting strategy. The team is receiving too many alerts, many of which are false positives. The manager wants to reduce alert noise without missing critical threats. Which approach aligns with SIEM best practices?

   • AIncrease the alert severity for all correlation searches to ensure they are noticed.
   • BUse a single correlation search for all threats to simplify management.
   • CDisable all correlation searches that generate more than 10 alerts per day.
   • DTune correlation searches by adjusting thresholds and adding context from Asset and Identity frameworks.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does the Common Information Model (CIM) enable consistent searching across different data sources?

   • ABy requiring all data to be stored in a single database
   • BBy converting all data into a single file format
   • CBy using machine learning to automatically classify data
   • DBy defining a common set of field names and tags that are applied to events from various sources
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A SOC manager wants to ensure that the SIEM provides continuous monitoring and timely alerts. The team is currently only reviewing alerts during business hours. What is a SIEM best practice the manager should implement?

   • AImplement 24/7 monitoring and alerting with defined escalation procedures.
   • BDisable alerts for low-priority events to reduce noise.
   • CReview alerts weekly to reduce analyst workload.
   • DOnly monitor during business hours to reduce noise.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In a security investigation, what does the CIM field `src` typically represent?

   • AThe source IP address or hostname of the event
   • BThe destination IP address or hostname of the event
   • CThe user account associated with the event
   • DThe signature or rule that triggered the alert
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is investigating a potential data exfiltration incident. The analyst wants to find all events where data was sent from an internal host to an external IP address. Which CIM field pair should the analyst use in the search to identify the source and destination of the traffic?

   • Auser and signature
   • Bsrc_ip and dest_ip
   • Chost and source
   • Dsrc and dest
   Reveal Solution Discussion Select an answer first