A security team wants to detect lateral movement within their network. They have authentication logs and process creation logs. Which anomaly detection approach would be most effective?

Alert on any failed login attempts.

Flag any new process that is not in a known-good list.

Monitor for any use of PowerShell on any host.

Model normal authentication patterns between hosts and flag unusual cross-host authentication.

A security analyst is setting up a threat hunting environment. They need to ensure that the data sources are properly configured to support anomaly detection and behavioral analytics. Which configuration step is most critical for enabling effective anomaly detection?

Enable verbose logging on all endpoints to capture every system event.

Collect and index security-relevant data sources such as authentication logs, process creation events, and network connections.

Install a SIEM solution to aggregate all logs in a central repository.

Set up alerts for all known indicators of compromise.

A security team is deploying an anomaly detection system. They have a diverse user base with different roles and working patterns. They want to minimize false positives while still detecting genuine threats. Which approach is most effective?

Create separate baselines for each user role and adjust for individual behavior over time.

Use a static rule that flags any activity outside of 9 AM to 5 PM.

Use a single global baseline for all users.

Rely solely on known IOCs to trigger alerts.

What is an indicator of compromise (IOC) in the context of threat detection?

A security control that prevents unauthorized access

A vulnerability in a software application that could be exploited

A log entry that records normal user activity

A piece of forensic data that suggests a system may be compromised

SplunkCertified Cybersecurity Defense Analyst

Domain 6Objective 1

Identify Threat Hunting Techniques Including Configuration, Modeling (anomalies), Indicators, and Behavioral Analytics. SPLK-5001 Practice Questions (Page 4)

Part of the Threat Hunting and Remediation domain, which accounts for 10% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

4concepts

10%of the exam

Questions 16–20

16application · medium
A security team wants to detect lateral movement within their network. They have authentication logs and process creation logs. Which anomaly detection approach would be most effective?
Select an answer first
17application · medium
A security analyst is setting up a threat hunting environment. They need to ensure that the data sources are properly configured to support anomaly detection and behavioral analytics. Which configuration step is most critical for enabling effective anomaly detection?
Select an answer first
18expert · hard
A security team is deploying an anomaly detection system. They have a diverse user base with different roles and working patterns. They want to minimize false positives while still detecting genuine threats. Which approach is most effective?
Select an answer first
19foundation · easy
Which of the following is a common type of indicator of compromise (IOC) used in Splunk threat hunting?
Select an answer first
20foundation · easy
What is an indicator of compromise (IOC) in the context of threat detection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.