Understand and Explain the Essentials of Risk Based Alerting, the Risk Framework and Creating Correlation Searches Within Enterprise Security. SPLK-5001 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the first step in creating a correlation search in Splunk Enterprise Security?

   • ADefining the search logic using SPL
   • BAssigning a risk score to the search
   • CScheduling the search to run at a specific interval
   • DSetting the alert actions
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is troubleshooting why a user's risk score is not increasing as expected. They have a correlation search that outputs risk events with a risk_score of 10. The search runs every 10 minutes and looks back 30 minutes. The user has had 5 events in the past 30 minutes, but the risk score only shows 10. What is the most likely cause?

   • AThe risk threshold is set too high, preventing the score from accumulating.
   • BThe risk_score field is not being output correctly by the search.
   • CThe search is generating a single risk event per run, not one per matching event.
   • DThe risk framework is aggregating the scores over a longer window, so the 5 events are not all counted yet.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An administrator is creating a correlation search to detect lateral movement. The search should identify when a user logs into multiple hosts within a short time. They want to use a transaction to group the events. What is a critical consideration when using transactions in a correlation search?

   • ATransactions can be resource-intensive and may require careful tuning of the maxspan and maxpause settings.
   • BTransactions should be used with a real-time search to ensure accuracy.
   • CTransactions automatically generate risk scores for the involved users.
   • DTransactions are the only way to correlate events in Splunk.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When does a risk-based alert generate a notable event in Splunk Enterprise Security?

   • AWhen the risk object type is changed in the configuration
   • BWhen a correlation search detects a single high-severity event
   • CWhen any risk event is recorded for a risk object
   • DWhen the accumulated risk score for a risk object reaches or exceeds a configured threshold
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A SOC is evaluating whether to adopt RBA. They currently have many correlation searches that generate notables for individual events. They are concerned that RBA might cause them to miss low-severity events that could be part of a larger attack. How should they address this concern?

   • AUse RBA only for users, not for hosts.
   • BSet the risk threshold very low to ensure all events generate notables.
   • CDisable all correlation searches and rely solely on RBA.
   • DUse RBA to aggregate risk scores, but also keep critical correlation searches that generate notables for high-severity events.
   Reveal Solution Discussion Select an answer first