A Splunk admin is configuring an adaptive response action to send an email notification when a notable event is created. The admin wants to ensure the notification is sent only for events with a severity of 'high' or 'critical'. What should the admin configure?

Use a custom command in the search to filter events

Add a condition in the action's configuration that checks the severity field

Create a correlation search that only returns high and critical events

Enable the action only for high-severity events

An analyst configures an adaptive response action to send an email notification when a notable event is created. During testing, the analyst finds that the email is not sent. The analyst verifies that the SMTP server is reachable and the email settings are correct. What should the analyst check next?

Whether the email recipient is in the same domain

Whether the notable event has a high severity

Whether the correlation search is scheduled to run

Whether the action is enabled and attached to the correct correlation search

A security analyst detects a suspicious outbound connection from a critical server to a known C2 domain. The organization's policy requires immediate containment of the affected host while preserving forensic evidence. The analyst has already confirmed the alert is a true positive. Which adaptive response action should be configured to meet the containment requirement?

Run a script that isolates the host using the EDR API

Send an email notification to the security team

Add the C2 domain to a blocklist

Create a new correlation search for the same indicator

An analyst is investigating a low-severity alert that indicates a user visited a known phishing site. The organization's policy states that low-severity alerts should be monitored but not automatically remediated. Which adaptive response action is most appropriate?

Quarantine the user's workstation

Block the user's account immediately

Create a notable event for manual review

Send an email to the user's manager

A security analyst is investigating a notable event for a potential insider threat. The organization's policy requires that any confirmed insider threat trigger an automatic lockout of the user's account, but only if the user is not a member of the executive team. The executive team is defined in an Active Directory group. Which adaptive response action should be configured?

Create a separate correlation search that excludes executive users

Send an email to the security team for manual review

Lock the account for all users and manually unlock executives later

Configure the action to check the user's group membership before locking the account

SplunkCertified Cybersecurity Defense Analyst

Domain 6Objective 3

Determine When to Use Adaptive Response Actions and Configure Them as Needed. SPLK-5001 Practice Questions (Page 4)

Part of the Threat Hunting and Remediation domain, which accounts for 10% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

4concepts

10%of the exam

Questions 16–20

16expert · medium
A Splunk admin is configuring an adaptive response action to send an email notification when a notable event is created. The admin wants to ensure the notification is sent only for events with a severity of 'high' or 'critical'. What should the admin configure?
Select an answer first
17application · medium
An analyst configures an adaptive response action to send an email notification when a notable event is created. During testing, the analyst finds that the email is not sent. The analyst verifies that the SMTP server is reachable and the email settings are correct. What should the analyst check next?
Select an answer first
18application · medium
A security analyst detects a suspicious outbound connection from a critical server to a known C2 domain. The organization's policy requires immediate containment of the affected host while preserving forensic evidence. The analyst has already confirmed the alert is a true positive. Which adaptive response action should be configured to meet the containment requirement?
Select an answer first
19application · medium
An analyst is investigating a low-severity alert that indicates a user visited a known phishing site. The organization's policy states that low-severity alerts should be monitored but not automatically remediated. Which adaptive response action is most appropriate?
Select an answer first
20expert · medium
A security analyst is investigating a notable event for a potential insider threat. The organization's policy requires that any confirmed insider threat trigger an automatic lockout of the user's account, but only if the user is not a member of the executive team. The executive team is defined in an Active Directory group. Which adaptive response action should be configured?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.

Determine When to Use Adaptive Response Actions and Configure Them as Needed. SPLK-5001 Practice Questions (Page 4)

Questions 16–20

A Splunk admin is configuring an adaptive response action to send an email notification when a notable event is created. The admin wants to ensure the notification is sent only for events with a severity of 'high' or 'critical'. What should the admin configure?

An analyst is investigating a low-severity alert that indicates a user visited a known phishing site. The organization's policy states that low-severity alerts should be monitored but not automatically remediated. Which adaptive response action is most appropriate?

Keep studying — Threat Hunting and Remediation