Understand and Explain the Essentials of Risk Based Alerting, the Risk Framework and Creating Correlation Searches Within Enterprise Security. SPLK-5001 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SOC is implementing RBA and has set a risk threshold of 80 for users. They have a correlation search that adds 20 risk points for each failed login. A user has had 3 failed logins in the past hour, bringing their risk score to 60. The SOC wants to be alerted when the user's risk score reaches 80. What is the most effective way to achieve this?

   • ASet the risk threshold to 60 in the risk-based alert.
   • BCreate a risk-based alert with a threshold of 80 and a lookback of 24 hours.
   • CUse a correlation search to generate a notable for each failed login and manually review.
   • DCreate a correlation search that triggers when the risk score field is greater than 80.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a key component of the Risk framework in Splunk Enterprise Security?

   • AAlert throttling
   • BLookup table definitions
   • CData model acceleration
   • DRisk factors
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is an example of an alert action that can be configured for a correlation search?

   • AModifying the search index
   • BCreating a notable event
   • CChanging the data model
   • DDeleting events from the index
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A Splunk admin is tuning the Risk framework. They notice that a user's risk score is increasing faster than expected. They want to understand how the risk score is calculated. Which statement accurately describes risk score calculation in the Risk framework?

   • ARisk scores are reset to zero after each notable is generated.
   • BRisk scores are based on the severity of the correlation search that generated the event.
   • CRisk scores are aggregated by summing the risk_score values from all risk events for a risk object within a rolling time window.
   • DRisk scores are calculated by multiplying the risk factor by the number of events in a single search result.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How can a correlation search contribute to the Risk framework in Splunk Enterprise Security?

   • ABy disabling the Risk framework for specific data sources
   • BBy outputting risk events that add risk scores to risk objects
   • CBy modifying the risk threshold for all risk objects
   • DBy directly creating incidents without generating notables
   Reveal Solution Discussion Select an answer first