Outline the Purpose and Scope of Annotations Within Splunk Enterprise Security. SPLK-5001 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC manager wants to ensure that when analysts add context to notable events, the information is retained for compliance audits and can be reviewed by the incident response team later. What should the manager configure or instruct the team to do?

   • AInstruct analysts to consistently add annotations to notable events for all significant findings.
   • BRequire analysts to export notable events to a PDF and save them in a shared drive.
   • CConfigure a scheduled search to email all notable event details to the compliance team daily.
   • DEnable a setting that automatically appends analyst notes to the raw event logs.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During a post-incident review, the team needs to identify all notable events that were annotated with the phrase 'confirmed malware' during the last quarter. How can the team retrieve this information from Splunk Enterprise Security?

   • ACheck the audit log for all annotation additions.
   • BSearch the annotations index or use the notable event's annotation fields in a search.
   • CExport all notable events to a CSV and manually search for the phrase.
   • DReview the raw event logs for the phrase 'confirmed malware'.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An analyst has added an annotation to a notable event but later realizes the annotation contains a typo. What is the correct way to fix the annotation in Splunk Enterprise Security?

   • AAdd a second annotation noting the typo and the correct information.
   • BModify the raw event data to include the correction.
   • CDelete the notable event and recreate it with the correct annotation.
   • DEdit the existing annotation to correct the typo.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How do annotations relate to the overall security investigation workflow in Splunk Enterprise Security?

   • AThey are automatically generated by the system for every notable event
   • BThey are used to store sensitive data that should not be visible to other analysts
   • CThey support collaboration and provide context that can guide the investigation and response
   • DThey are optional and only used for documentation, not for analysis
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In Splunk Enterprise Security, what is the primary purpose of adding an annotation to a notable event?

   • ATo generate a new correlation search based on the event data
   • BTo provide additional context and enrich the notable event for analysts
   • CTo permanently delete the notable event from the system
   • DTo automatically change the status of the notable event to 'resolved'
   Reveal Solution Discussion Select an answer first