An analyst wants to add an annotation to a notable event that includes the affected user's role, the department, and a note about the user's recent activity. What is the most efficient way to capture this information?

Create a new notable event with the user's details and link it to the original.

Update the user's identity record in the Assets and Identities framework.

Add three separate annotations: one for role, one for department, and one for activity.

Add a single annotation with fields for role, department, and a note for recent activity.

A security analyst is investigating a notable event involving a compromised user account. The analyst has confirmed the compromise through multiple data sources and wants to document the findings directly on the notable event so that the next analyst on shift can understand the investigation without redoing the work. Which action should the analyst take?

Send an email to the security team with the investigation summary.

Modify the underlying raw event data in the index to include the findings.

Create a new correlation search to generate a separate notable event with the findings.

Add an annotation to the notable event with the investigation details and findings.

A security analyst is working on a notable event and wants to add a hyperlink to an external threat intelligence report for reference. What should the analyst do?

Create a new correlation search that includes the URL in the event description.

Add the URL to the asset's identity record.

Modify the notable event's title to include the URL.

Add an annotation with the URL in the note field.

A security analyst is reviewing a notable event and notices that the event was annotated by a previous analyst with a note saying 'False positive - user was on VPN.' The current analyst wants to verify this claim before closing the event. What is the most appropriate action?

Review the annotation and then investigate the raw events to verify the VPN connection.

Escalate the event to a senior analyst without further investigation.

Delete the annotation and re-investigate the event from scratch.

Trust the annotation and close the event as a false positive.

In Splunk Enterprise Security, which type of information can be captured in an annotation on a notable event?

Only the timestamp of when the event was first detected

Free-form text notes, links to external resources, and references to other events

Only the username of the analyst who created the event

Only the raw log data from the original source system

SplunkCertified Cybersecurity Defense Analyst

Domain 2Objective 4

Outline the Purpose and Scope of Annotations Within Splunk Enterprise Security. SPLK-5001 Practice Questions (Page 3)

Part of the Threat and Attack Types, Motivations, and Tactics domain, which accounts for 20% of the SPLK-5001 exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 15 practice questions to prepare you well beyond it. (estimate)

15questions here

3free pages

2concepts

20%of the exam

Questions 11–15

11application · medium
An analyst wants to add an annotation to a notable event that includes the affected user's role, the department, and a note about the user's recent activity. What is the most efficient way to capture this information?
Select an answer first
12application · medium
A security analyst is investigating a notable event involving a compromised user account. The analyst has confirmed the compromise through multiple data sources and wants to document the findings directly on the notable event so that the next analyst on shift can understand the investigation without redoing the work. Which action should the analyst take?
Select an answer first
13application · medium
A security analyst is working on a notable event and wants to add a hyperlink to an external threat intelligence report for reference. What should the analyst do?
Select an answer first
14application · medium
A security analyst is reviewing a notable event and notices that the event was annotated by a previous analyst with a note saying 'False positive - user was on VPN.' The current analyst wants to verify this claim before closing the event. What is the most appropriate action?
Select an answer first
15foundation · easy
In Splunk Enterprise Security, which type of information can be captured in an annotation on a notable event?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SPLK-5001

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-5001” is a trademark of its owner, used for identification only.