A security analyst is reviewing a notable event for a potential data exfiltration. The organization's policy requires that any confirmed exfiltration trigger an automatic block of the user's account. The analyst has confirmed the exfiltration. Which adaptive response action should be configured?

Run a search to find other exfiltration events

Send an email to the security team

Disable the user's account via the identity management integration

Create a notable event for manual review

Which scenario is most appropriate for a manual adaptive response action?

A routine alert that is always handled the same way

A low-severity alert that requires no action

A potential threat that needs investigation before deciding on remediation steps

A high-severity incident that requires immediate containment without analyst review

In Splunk, what is the primary purpose of adaptive response actions?

To generate compliance reports for regulatory audits

To replace the need for threat hunting by automatically identifying all threats in the environment

To provide a framework for executing automated or manual remediation steps in response to detected threats

To automatically remediate threats without requiring any human approval or oversight

How can Splunk integrate an adaptive response action with an external system?

By sending a syslog message to the system

By using a REST API call to the external system

By exporting data to a CSV file

By using a database connection string

A Splunk admin configures an adaptive response action to block a malicious IP on a firewall. During testing, the admin triggers the correlation search and the action appears to run, but the firewall does not block the IP. The admin checks the firewall logs and sees no API call from Splunk. What is the most likely cause?

The correlation search is not generating notable events

The action is configured with the wrong API endpoint or credentials

The firewall is not compatible with the API

SplunkCertified Cybersecurity Defense Analyst

Domain 6Objective 3

Determine When to Use Adaptive Response Actions and Configure Them as Needed. SPLK-5001 Practice Questions (Page 1)

Part of the Threat Hunting and Remediation domain, which accounts for 10% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

4concepts

10%of the exam

Questions 1–5

1application · medium
A security analyst is reviewing a notable event for a potential data exfiltration. The organization's policy requires that any confirmed exfiltration trigger an automatic block of the user's account. The analyst has confirmed the exfiltration. Which adaptive response action should be configured?
Select an answer first
2foundation · easy
Which scenario is most appropriate for a manual adaptive response action?
Select an answer first
3foundation · easy
In Splunk, what is the primary purpose of adaptive response actions?
Select an answer first
4foundation · easy
How can Splunk integrate an adaptive response action with an external system?
Select an answer first
5expert · medium
A Splunk admin configures an adaptive response action to block a malicious IP on a firewall. During testing, the admin triggers the correlation search and the action appears to run, but the firewall does not block the IP. The admin checks the firewall logs and sees no API call from Splunk. What is the most likely cause?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.