A threat hunting team wants to ensure they have comprehensive visibility into network traffic for hunting activities. Which data source configuration would provide the most useful information for detecting command-and-control (C2) communication?

Use a DNS sinkhole to block known malicious domains.

Deploy a full packet capture (PCAP) solution on the internet-facing perimeter.

Configure the firewall to log all allowed and denied traffic.

Enable NetFlow on all routers and switches to capture flow data.

A threat hunter is investigating a potential compromise and has identified a suspicious domain that is not on any threat intelligence feed. What is the best way to determine if this domain is malicious?

Check the domain's WHOIS information to see who registered it.

Add the domain to the threat intelligence feed for future reference.

Search the organization's DNS logs for any queries to the domain.

Block the domain immediately to prevent any potential communication.

A threat hunting team is setting up a new hunting environment. They want to ensure that they can quickly search for indicators of compromise across all their data. What is the most important configuration step?

Index all data sources and ensure they are searchable in a central platform.

Use a threat intelligence platform to manage IOCs.

Create a separate data store for each data source.

Set up alerts for all known IOCs.

A security team wants to detect compromised accounts by identifying unusual login patterns. They have historical authentication data. Which approach best models normal behavior for each user?

Apply a machine learning model trained on public datasets of login behavior.

Create a global baseline for all users based on average login times and locations.

Build a per-user baseline using historical login times, locations, and frequency.

Use a static rule that flags any login outside business hours.

A security analyst is investigating a potential insider threat. The analyst has access to user activity logs, but the organization has a strict privacy policy that limits the use of personal data. How should the analyst proceed?

Request permission from the user to access their logs.

Use the logs to analyze user behavior without focusing on individual identities.

Only use logs that are not considered personal data.

Ignore the privacy policy because security is more important.

SplunkCertified Cybersecurity Defense Analyst

Domain 6Objective 1

Identify Threat Hunting Techniques Including Configuration, Modeling (anomalies), Indicators, and Behavioral Analytics. SPLK-5001 Practice Questions (Page 1)

Part of the Threat Hunting and Remediation domain, which accounts for 10% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

4concepts

10%of the exam

Questions 1–5

1application · medium
A threat hunting team wants to ensure they have comprehensive visibility into network traffic for hunting activities. Which data source configuration would provide the most useful information for detecting command-and-control (C2) communication?
Select an answer first
2application · medium
A threat hunter is investigating a potential compromise and has identified a suspicious domain that is not on any threat intelligence feed. What is the best way to determine if this domain is malicious?
Select an answer first
3application · medium
A threat hunting team is setting up a new hunting environment. They want to ensure that they can quickly search for indicators of compromise across all their data. What is the most important configuration step?
Select an answer first
4application · medium
A security team wants to detect compromised accounts by identifying unusual login patterns. They have historical authentication data. Which approach best models normal behavior for each user?
Select an answer first
5expert · hard
A security analyst is investigating a potential insider threat. The analyst has access to user activity logs, but the organization has a strict privacy policy that limits the use of personal data. How should the analyst proceed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.