Understand and Explain the Essentials of Risk Based Alerting, the Risk Framework and Creating Correlation Searches Within Enterprise Security. SPLK-5001 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which statement best describes how correlation searches detect threats?

   • AThey analyze relationships and patterns across multiple events and sources
   • BThey rely solely on machine learning models to classify events
   • CThey only monitor a single data source at a time
   • DThey compare events against a static list of known malicious IPs
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is reviewing the Risk framework in Splunk Enterprise Security. They notice that a user has a risk score of 45, but the risk threshold for generating a notable is 50. The user has had multiple failed logins and a suspicious download. What will happen regarding notables and incidents?

   • AThe risk score will be reset to zero after 24 hours, and no notable will be generated.
   • BNo notable will be generated until the risk score reaches or exceeds 50.
   • CA notable will be generated because the risk score is close to the threshold.
   • DAn incident will be created automatically because the user has multiple risk events.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An administrator is creating a correlation search to detect multiple failed logins followed by a successful login. They want the search to run every 5 minutes and look back 15 minutes. They also want to ensure that the search does not generate an alert for the same user more than once per hour. What is the most efficient way to configure this?

   • AUse a stats command to count failed logins and successful logins, and set the schedule to 15 minutes.
   • BUse a transaction to group the events, set the schedule to 5 minutes, and enable throttling on the user field with a 60-minute window.
   • CUse a join command to combine failed and successful logins, and disable throttling.
   • DSet the schedule to 5 minutes and use a real-time search to detect the pattern.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which core principle best describes how Risk-Based Alerting evaluates security events?

   • ARisk is accumulated and attributed to entities over time
   • BRisk is assessed per individual event without considering historical activity
   • CEvery alert is treated with equal severity regardless of source
   • DAlerts are only generated when a single event exceeds a high severity threshold
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary role of a correlation search in Splunk Enterprise Security?

   • ATo detect security threats by correlating events across multiple data sources
   • BTo manage user access and permissions
   • CTo visualize data in dashboards
   • DTo index and store raw event data
   Reveal Solution Discussion Select an answer first