33 free Splunk SPLK-5001 practice questions from the CertStash pack of 131, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 33 free here, all 131 in the pack, and each step includes the one before it.
Get all 131 questions (US$39) · Download the first 10 as a PDF
Question 1
Which Enterprise Security framework provides a mechanism for running preconfigured actions within the Splunk platform or integrating with external applications?
Show answer and explanation
Correct answer: D. Adaptive Response
Adaptive Response is the Enterprise Security framework feature that provides a mechanism for running preconfigured actions within Splunk or integrating with external applications. It allows automated response actions to be triggered based on correlation search results, enabling both internal Splunk actions and third-party integrations.
Why the other options are wrong
- A. Asset and Identity provides data enrichment and contextualization but does not handle automated response actions.
- B. Notable Event is a concept for alerting on significant security events but is not a framework for running preconfigured actions.
- C. Threat Intelligence provides threat data enrichment and context but is not the mechanism for running response actions.
Question 2
Which of the following Splunk Enterprise Security features allows industry frameworks such as CIS Critical Security Controls, MITRE ATT&CK, and the Lockheed Martin Cyber Kill Chain® to be mapped to Correlation Search results?
Show answer and explanation
Correct answer: A. Annotations
Annotations in Splunk Enterprise Security allow industry frameworks and security standards such as CIS Critical Security Controls, MITRE ATT&CK, and the Lockheed Martin Cyber Kill Chain to be mapped and associated with Correlation Search results. This provides context and compliance mapping for security findings.
Why the other options are wrong
- B. Playbooks are automated response workflows, not mapping mechanisms for framework alignment.
- C. Comments are general notes added to events but are not a structured feature for framework mapping.
- D. Enrichments add contextual data to events but do not provide structured mapping to security frameworks.
Question 3
Which of the following is the primary benefit of using the CIM in Splunk?
Show answer and explanation
Correct answer: A. It allows for easier correlation of data from different sources.
The primary benefit of the Common Information Model (CIM) in Splunk is that it allows for easier correlation of data from different sources. CIM provides a standardized field naming convention and data structure that enables consistent analysis across heterogeneous data sources regardless of their origin.
Why the other options are wrong
- B. Performance on raw data is determined by index structure and query optimization, not CIM.
- C. While CIM enables analytics, it does not specifically enable machine learning algorithms.
- D. CIM is a data modeling framework; threat detection and blocking are functional outcomes that depend on correlation searches and response actions built on top of CIM.
Question 4
Tactics, Techniques, and Procedures (TTPs) are methods or behaviors utilized by attackers. In which framework are these categorized?
Show answer and explanation
Correct answer: D. MITRE ATT&CK
Tactics, Techniques, and Procedures (TTPs) are categorized within the MITRE ATT&CK framework. MITRE ATT&CK provides a comprehensive knowledge base of adversary tactics and techniques based on real-world observations, organized hierarchically with tactics at the highest level and specific techniques and sub-techniques beneath them.
Why the other options are wrong
- A. NIST 800-53 is a security controls framework, not a TTP categorization system.
- B. ISO 27000 series addresses information security management but does not categorize TTPs.
- C. CIS 18 refers to CIS Critical Security Controls, which are control recommendations rather than a TTP categorization framework.
Question 5
A threat hunter executed a hunt based on the following hypothesis: As an actor, I want to plant rundll32 for proxy execution of malicious code and leverage Cobalt Strike for Command and Control. Relevant logs and artifacts such as Sysmon, netflow, IDS alerts, and EDR logs were searched, and the hunter is confident in the conclusion that Cobalt Strike is not present in the company’s environment. Which of the following best describes the outcome of this threat hunt?
Show answer and explanation
Correct answer: D. The threat hunt was successful in providing strong evidence that the tactic and tool is not present in the environment.
A threat hunt is successful when it provides conclusive evidence about the presence or absence of a threat, regardless of which outcome occurs. In this case, the hunter thoroughly searched multiple relevant data sources and reached a confident conclusion that Cobalt Strike is not present in the environment. This represents a successful hunt outcome with strong supporting evidence.
Why the other options are wrong
- A. Success is not merely the absence of proof; it requires thorough investigation and confident conclusions.
- B. The hunt was not a failure; the hypothesis was fully investigated and a confident conclusion was reached.
- C. Threat hunts can succeed by proving the absence of threats; identifying malicious activity is not the only measure of success.
Question 6
An analyst notices that one of their servers is sending an unusually large amount of traffic, gigabytes more than normal, to a single system on the Internet. There doesn’t seem to be any associated increase in incoming traffic. What type of threat actor activity might this represent?
Show answer and explanation
Correct answer: A. Data exfiltration
Large outbound traffic to an external system without corresponding inbound traffic is a classic indicator of data exfiltration. An attacker has likely compromised the server and is extracting sensitive data to an external location they control. The asymmetry in traffic direction and volume strongly suggests unauthorized data removal.
Why the other options are wrong
- B. Network reconnaissance typically involves scanning and probing multiple systems, not sustained large data transfers to a single destination.
- C. Data infiltration would manifest as incoming traffic from external sources, not outgoing traffic.
- D. Lateral movement occurs between internal systems and would not necessarily show large volumes of traffic to a single external internet system.
Question 7
In which phase of the Continuous Monitoring cycle are suggestions and improvements typically made?
Show answer and explanation
Correct answer: C. Analyze and Report
The Analyze and Report phase of the Continuous Monitoring cycle is where analysts examine collected data, identify patterns and anomalies, and generate reports with findings. Suggestions and improvements for the monitoring program are typically made during this phase based on analysis results and organizational needs.
Why the other options are wrong
- A. Define and Predict involves planning and establishing the monitoring strategy, not making post-analysis improvements.
- B. Establish and Architect focuses on building the monitoring infrastructure and baselines.
- D. Implement and Collect is the execution phase where data is gathered, not where analysis-driven improvements are suggested.
Question 8
An analyst is not sure that all of the potential data sources at her company are being correctly or completely utilized by Splunk and Enterprise Security. Which of the following might she suggest using, in order to perform an analysis of the data types available and some of their potential security uses?
Show answer and explanation
Correct answer: B. Splunk Security Essentials
Splunk Security Essentials provides analysis and guidance on available data types, their security applications, and recommendations for optimizing data collection and utilization. It helps analysts understand potential data sources and their security use cases, making it ideal for assessing whether all organizational data is being properly leveraged.
Why the other options are wrong
- A. Splunk ITSI (IT Service Intelligence) focuses on IT operations and performance monitoring, not security data source analysis.
- C. Splunk SOAR (Security Orchestration, Automation and Response) is a platform for automating security response workflows, not analyzing available data sources.
- D. Splunk Intelligence Management is not a standard Splunk product for data source assessment and security use case mapping.
Question 9
During their shift, an analyst receives an alert about an executable being run from C: \Windows\Temp. Why should this be investigated further?
Show answer and explanation
Correct answer: D. Temp directories are world writable thus allowing attackers a place to drop, stage, and execute malware on a system without needing to worry about file permissions.
Temp directories like C:\Windows\Temp are world-writable locations that do not require special permissions to write to, making them ideal locations for attackers to drop and stage malware before execution. This is a common technique in the attack chain because the low permission requirements allow malware to be placed and executed without needing elevated privileges or triggering permission-based alerts.
Why the other options are wrong
- A. Temp directories can be tracked through file system logs and process execution logs that record which user context initiated the execution.
- B. Temp directories are not flagged as non-executable; executables regularly run from these locations, which is precisely why this is suspicious.
- C. Temp directories do not contain the system page file or virtual memory file; these are located elsewhere in the Windows system structure.
Question 10
An analyst would like to visualize threat objects across their environment and chronological risk events for a Risk Object in Incident Review. Where would they find this?
Show answer and explanation
Correct answer: D. Clicking the risk event count to open the Risk Event Timeline.
Clicking the risk event count on a Risk Object in Incident Review opens the Risk Event Timeline, which provides a chronological visualization of risk events associated with that object across the environment. This is the standard interface within Splunk Enterprise Security for viewing the timeline and distribution of risk events.
Why the other options are wrong
- A. Running the Risk Analysis Adaptive Response action generates analysis but does not provide the timeline visualization in the same manner.
- B. Workflow actions for the Risk Investigation dashboard are separate from the risk event count visualization.
- C. The Risk Analysis dashboard is found in Enterprise Security but the risk timeline specifically comes from clicking the event count in Incident Review.
What people say about the full SPLK-5001 pack 5.0 from 3
Question 11
While testing the dynamic removal of credit card numbers, an analyst lands on using the rex command. What mode needs to be set to in order to replace the defined values with X? | makeresults | eval ccnumber="511388720478619733" | rex field=ccnumber mode=??? "s/(\d{4}-){3)/XXXX-XXXX-XXXX-/g" Please assume that the above rex command is correctly written.
Show answer and explanation
Correct answer: A. sed
The rex command uses sed-style regular expression syntax for pattern matching and replacement operations. When setting mode=sed, the rex command performs substitution operations using sed regex syntax, which is the standard for the rex command. The syntax shown with the s/// delimiter is characteristic of sed-style regex replacement. This mode enables the use of sed-like regex patterns to find and replace content in fields.
Why the other options are wrong
- B. Replace is not a valid mode parameter for the rex command.
- C. Mask mode is used for field masking operations in different contexts, not for regex-based substitution in rex.
- D. Substitute is not a valid mode parameter for the rex command.
Question 12
Which of the following use cases is best suited to be a Splunk SOAR Playbook?
Show answer and explanation
Correct answer: D. Taking containment action on a compromised host.
Splunk SOAR Playbooks are designed to automate security response actions, such as containment, remediation, and investigation tasks. Taking containment action on a compromised host is a direct automation use case that SOAR excels at, as it involves executing predefined workflows and actions in response to security events. Option A is suited for threat hunting analysis rather than automation. Option B relates to visualization and dashboarding. Option C is a data management task better suited to Splunk indexing configuration.
Why the other options are wrong
- A. Forming hypotheses for threat hunting is an analytical process that requires human investigation and creativity, not automation.
- B. Visualizing complex datasets is a dashboard and reporting function, not a SOAR Playbook automation use case.
- C. Creating persistent field extractions is a data management and indexing configuration task, not a SOAR Playbook function.
Question 13
Which of the following is not a component of the Splunk Security Content library (ESCU, SSE)?
Show answer and explanation
Correct answer: D. Validated architectures
Validated architectures are not a component of the Splunk Security Content (ESCU/SSE) library. The library contains dashboards, reports, correlation searches, and detection searches, but architectural validation guidance falls outside the scope of the content library itself.
Why the other options are wrong
- A. Dashboards are core components of ESCU/SSE for visualization and monitoring.
- B. Reports are included in ESCU/SSE for security analysis and alerting.
- C. Correlation searches are fundamental detection components of ESCU/SSE.
Question 14
A Risk Notable Event has been triggered in Splunk Enterprise Security, an analyst investigates the alert, and determines it is a false positive. What metric would be used to define the time between alert creation and close of the event?
Show answer and explanation
Correct answer: A. MTTR (Mean Time to Respond)
Mean Time to Respond (MTTR) measures the elapsed time from when an alert is generated until the alert or event is closed, covering the entire investigation and resolution process. This directly corresponds to the scenario where an alert is created, investigated, and then closed as a false positive. MTTA measures time to acknowledgment only, MTBF is for reliability engineering, and MTTD measures detection time from actual compromise.
Why the other options are wrong
- B. MTBF (Mean Time Between Failures) is used in reliability engineering, not for alert response metrics.
- C. MTTA (Mean Time to Acknowledge) only measures the time to acknowledge an alert, not the full resolution time.
- D. MTTD (Mean Time to Detect) measures the time from initial compromise to detection, not investigation and closure.
Question 15
According to David Bianco's Pyramid of Pain, which indicator type is least effective when used in continuous monitoring?
Show answer and explanation
Correct answer: D. Hash values
According to David Bianco's Pyramid of Pain, hash values are the least effective indicator type for continuous monitoring because they are the easiest for attackers to change. A single byte modification creates a completely different hash, so attackers can trivially evade hash-based detection. Hash indicators are at the bottom of the pyramid, representing the least painful indicators for adversaries to overcome.
Why the other options are wrong
- A. Domain names are more difficult for attackers to change than hashes because they require setting up new infrastructure.
- B. TTPs (Tactics, Techniques, and Procedures) are at the top of the pyramid and are the most effective and painful for attackers to change.
- C. Network and host artifacts are more difficult to change than hashes and represent a higher level in the pyramid.
Question 16
Upon investigating a report of a web server becoming unavailable, the security analyst finds that the web server’s access log has the same log entry millions of times: 147.186.119.200 - - [28/Jul/2023:12:04:13 -0300] "GET /login/ HTTP/1.0" 200 3733 What kind of attack is occurring?
Show answer and explanation
Correct answer: A. Denial of Service Attack
The log entry shows a single source IP (147.186.119.200) making millions of identical requests to the /login/ endpoint, resulting in the web server becoming unavailable. This is a Denial of Service attack from a single source attempting to exhaust server resources through request flooding. A Distributed Denial of Service attack would involve multiple source IPs, but this attack originates from one IP address.
Why the other options are wrong
- B. While the term Distributed is sometimes loosely applied, this attack comes from a single source IP, making it a standard DoS rather than a distributed attack.
- C. Cross-Site Scripting attacks exploit client-side vulnerabilities through malicious scripts, not through repetitive GET requests.
- D. Database Injection attacks target database queries with malicious input, not simple repetitive HTTP requests to a login endpoint.
Question 17
An analyst is investigating how an attacker successfully performs a brute-force attack to gain a foothold into an organizations systems. In the course of the investigation the analyst determines that the reason no alerts were generated is because the detection searches were configured to run against Windows data only and excluding any Linux data. This is an example of what?
Show answer and explanation
Correct answer: C. A False Negative.
A False Negative occurs when a security event actually happens (the brute-force attack was real) but no alert is generated (due to exclusion of Linux data from the search). The detection failed to catch a genuine attack because of configuration limitations.
Why the other options are wrong
- A. A True Positive occurs when malicious activity is detected and an alert correctly fires.
- B. A True Negative occurs when no malicious activity occurs and no alert is generated.
- D. A False Positive occurs when an alert fires but no actual malicious activity occurred.
Question 18
According to Splunk CIM documentation, which field in the Authentication Data Model represents the user who initiated a privilege escalation?
Show answer and explanation
Correct answer: C. src_user
According to Splunk's Common Information Model (CIM) documentation for the Authentication data model, src_user represents the source user or the user who initiated an action, including privilege escalation events. The src_user field is specifically designed to capture the identity of the user performing the action at the source. The username field is more generic, src_user_id represents an identifier rather than the user name itself, and dest_user represents the destination or target user in authentication scenarios.
Why the other options are wrong
- A. Username is too generic and does not specifically denote the source user in the CIM Authentication model.
- B. src_user_id is an identifier field, not the username field that represents the user who initiated the action.
- D. dest_user represents the target or destination user, not the user who initiated the privilege escalation.
Question 19
A successful Continuous Monitoring initiative involves the entire organization. When an analyst discovers the need for more context or additional information, perhaps from additional data sources or altered correlation rules, to what role would this request generally escalate?
Show answer and explanation
Correct answer: C. Security Engineer
When an analyst discovers a need for technical modifications such as additional data source integration or altered correlation rule logic, this escalates to a Security Engineer who has the technical expertise to implement infrastructure and configuration changes. A SOC Manager handles operational oversight, a Security Analyst performs investigation and detection, and a Security Architect designs broader security strategies.
Why the other options are wrong
- A. SOC Manager oversees operations and team performance, not technical implementation of rule changes.
- B. Security Analyst identifies the need but does not typically implement technical infrastructure changes.
- D. Security Architect designs overall security strategies rather than implementing specific correlation rule modifications.
Question 20
After discovering some events that were missed in an initial investigation, an analyst determines this is because some events have an empty src field. Instead, the required data is often captured in another field called machine_name. What SPL could they use to find all relevant events across either field until the field extraction is fixed?
Show answer and explanation
Correct answer: A. | eval src = coalesce(src,machine_name)
The coalesce() function returns the first non-null value from the fields provided in order. Using eval src = coalesce(src,machine_name) will populate the src field with its original value if available, or fall back to machine_name if src is empty, allowing searches to work uniformly across either field.
Why the other options are wrong
- B. The + operator performs numeric addition and cannot concatenate field values in the way needed to unify the two sources.
- C. The . operator is string concatenation and would combine both values rather than selecting one based on availability.
- D. The tostring() function converts a value to string format but does not choose between two fields or handle empty values differently.
Question 21
Which field is automatically added to search results when assets are properly defined and enabled in Splunk Enterprise Security?
Show answer and explanation
Correct answer: A. asset_category
When assets are properly defined and enabled in Splunk Enterprise Security, the asset_category field is automatically added to search results. This field categorizes assets based on their type and role in the organization, enriching security data with asset context automatically.
Why the other options are wrong
- B. src_ip is not automatically added by asset definitions; it must already exist in the data.
- C. src_category is derived from asset definitions but asset_category is the primary automatic field added.
- D. user field is not automatically added by asset configuration.
Question 22
An analyst is building a search to examine Windows XML Event Logs, but the initial search is not returning any extracted fields. Based on the above image, what is the most likely cause?
Show answer and explanation
Correct answer: C. The analyst did not add the extract command to their search pipeline.
The search is displaying raw XML event log data without any extracted fields being automatically available. The SELECTED FIELDS section shows only 'host 1', 'source 1', and 'sourceType 1', while the INTERESTING FIELDS section shows limited fields like 'index 1', 'linecount 1', and 'splunk_server 1'. For XML event logs to have properly extracted fields displayed, the analyst must explicitly use the extract command in their search pipeline to parse the XML structure and create named field-value pairs. Without the extract command, Splunk treats the data as raw text and does not automatically parse the XML tags into structured fields.
Why the other options are wrong
- A. Role-based access would prevent the analyst from running the search entirely, not from extracting fields from data they can already see.
- B. Data improperly parsed during indexing would result in corrupted data or search errors, not simply absent extracted fields that can be created on-demand with extract.
- D. Search mode (Smart vs Verbose) affects which fields Splunk automatically displays, but does not prevent field extraction; the extract command is still required to parse XML into named fields.
Question 23
An analyst is attempting to investigate a Notable Event within Enterprise Security. Through the course of their investigation they determined that the logs and artifacts needed to investigate the alert are not available. What event disposition should the analyst assign to the Notable Event?
Show answer and explanation
Correct answer: D. Other, since a security engineer needs to ingest the required logs.
When an analyst cannot investigate a Notable Event due to missing logs and artifacts, the appropriate disposition is Other. This indicates that the event cannot be properly categorized as True Positive, False Positive, or Benign Positive without the necessary evidence. The Other disposition signals that additional context or data ingestion is needed before a determination can be made, which aligns with the fact that a security engineer needs to ingest the required logs. This prevents premature closure and ensures the event is flagged for further action.
Why the other options are wrong
- A. Benign Positive is incorrect because the absence of logs does not prove the event did not occur; it means the event cannot be investigated.
- B. False Negative is an incorrect term in this context; the event cannot be classified without evidence.
- C. True Positive cannot be assigned without evidence of actual compromise or activity.
Question 24
What is the main difference between hypothesis-driven and data-driven Threat Hunting?
Show answer and explanation
Correct answer: B. Data-driven hunting tries to uncover activity within an existing data set, hypothesis-driven hunting begins with a potential activity that the hunter thinks may be happening.
Data-driven threat hunting examines existing datasets to uncover suspicious activity through analysis, while hypothesis-driven threat hunting begins with a theory or suspicion about specific activity that the hunter believes may be occurring. The key distinction is whether the hunting process starts with existing data exploration or with a predefined hypothesis.
Why the other options are wrong
- A. Data volume requirements do not define the difference between these methodologies; both can work with varying amounts of data.
- C. Data source age does not differentiate between hypothesis-driven and data-driven hunting approaches.
- D. This reverses the definitions; hypothesis-driven begins with a theory and data-driven begins with exploring data, not the other way around.
Question 25
Which of the following is a tactic used by attackers, rather than a technique?
Show answer and explanation
Correct answer: A. Gathering information about a target.
Gathering information about a target is a tactic in the MITRE ATT&CK framework. Tactics represent the strategic objectives or high-level goals an attacker wants to achieve. The other options describe specific techniques or methods used to accomplish those tactical objectives.
Why the other options are wrong
- B. Establishing persistence with a scheduled task is a specific technique, not a tactic.
- C. Using phishing email for initial access is a specific technique, not a tactic.
- D. UAC bypass for privilege escalation is a specific technique, not a tactic.
Question 26
Which of the following is a best practice when creating performant searches within Splunk?
Show answer and explanation
Correct answer: C. Utilize specific fields to return only the data that is required.
Specifying only required fields in searches reduces data processing overhead and network transmission, significantly improving search performance. This is a core best practice in Splunk optimization.
Why the other options are wrong
- A. The transaction command is resource-intensive and can degrade performance rather than improve it.
- B. Streaming commands should precede aggregating commands for optimal performance, not the reverse.
- D. Using multiple wildcards increases processing overhead and data returned, degrading performance rather than ensuring it.
Question 27
What is the following step-by-step description an example of? 1. The attacker devises a non-default beacon profile with Cobalt Strike and embeds this within a document. 2. The attacker creates a unique email with the malicious document based on extensive research about their target. 3. When the victim opens this document, a C2 channel is established to the attacker’s temporary infrastructure on a compromised website.
Show answer and explanation
Correct answer: C. Procedure
A procedure is a step-by-step description of how an attack is executed. The scenario provides detailed sequential steps showing how an attacker crafts and delivers a specific attack using Cobalt Strike, establishing C2 communication through a customized workflow tailored to a target.
Why the other options are wrong
- A. A tactic is a category of behavior or goal, not the detailed execution steps.
- B. A policy is a governance document or organizational rule, not an attack execution description.
- D. A technique is a specific tool or method (like using Cobalt Strike), whereas this describes the complete execution workflow.
Question 28
The Security Operations Center (SOC) manager is interested in creating a new dashboard for typosquatting after a successful campaign against a group of senior executives. Which existing ES dashboard could be used as a starting point to create a custom dashboard?
Show answer and explanation
Correct answer: D. New Domain Analysis
The New Domain Analysis dashboard is the most appropriate starting point for creating a typosquatting detection dashboard. Typosquatting involves registering domains with names similar to legitimate ones, making new domain analysis the relevant foundation for monitoring suspicious domain registration and access patterns.
Why the other options are wrong
- A. IAM Activity focuses on identity and access management but does not specifically address domain-based threats like typosquatting.
- B. Malware Center is designed for malware detection and analysis, not domain-based threat detection.
- C. Access Anomalies monitors unusual access patterns but does not specifically address domain registration or typosquatting threats.
Question 29
The United States Department of Defense (DoD) requires all government contractors to provide adequate security safeguards referenced in National Institute of Standards and Technology (NIST) 800-171. All DoD contractors must continually reassess, monitor, and track compliance to be able to do business with the US government. Which feature of Splunk Enterprise Security provides an analyst context for the correlation search mapping to the specific NIST guidelines?
Show answer and explanation
Correct answer: C. Annotations
Splunk Enterprise Security uses annotations on correlation searches to map them to industry frameworks such as NIST, CIS 20, MITRE ATT&CK and the Kill Chain. These annotations appear with notable events, giving analysts context about which specific NIST guideline a detection relates to. This supports continual compliance tracking for NIST 800-171.
Why the other options are wrong
- A. Comments are free-text remarks and do not map correlation searches to framework controls.
- B. Notes let analysts record investigation details but do not provide framework mapping for correlation searches.
- D. Framework mapping is not the name of a Splunk Enterprise Security feature; the mapping is done through annotations.
Question 30
An analysis of an organization’s security posture determined that a particular asset is at risk and a new process or solution should be implemented to protect it. Typically, who would be in charge of implementing the new process or solution that was selected?
Show answer and explanation
Correct answer: C. Security Engineer
A Security Engineer is responsible for implementing new processes and solutions to protect assets and improve security posture. They translate the requirements identified during security analysis into actual technical implementations, configurations, and deployments.
Why the other options are wrong
- A. A Security Architect designs solutions at a high level but typically does not implement them directly.
- B. A SOC Manager oversees operations and personnel but is not typically hands-on with implementation.
- D. A Security Analyst identifies risks and makes recommendations but does not typically implement the solutions themselves.
Question 31
An analyst is looking at Web Server logs, and sees the following entry as the last web request that a server processed before unexpectedly shutting down: 147.186.119.107 - - [28/Jul/2006:10:27:10 -0300] "POST /cgi-bin/shutdown/ HTTP/1.0" 200 3333 What kind of attack is most likely occurring?
Show answer and explanation
Correct answer: B. Denial of service attack.
The log entry shows a single POST request to a shutdown URI immediately before the server unexpectedly shuts down. This indicates a Denial of Service attack where a single source is targeting a specific vulnerability or endpoint to crash the service. The HTTP 200 response suggests the request succeeded in executing the shutdown function. This is a DoS rather than a DDoS because it involves a single source IP address (147.186.119.107). There is no evidence of distributed sources, database injection syntax, or script injection attempts.
Why the other options are wrong
- A. A distributed denial of service attack requires multiple sources; this shows only a single source IP.
- C. Database injection would involve SQL syntax or attempts to manipulate a database, not a shutdown URI call.
- D. Cross-Site scripting attacks involve injecting malicious scripts into web pages, not making direct POST requests to shutdown endpoints.
Question 32
An IDS signature is designed to detect and alert on logins to a certain server, but only if they occur from 6:00 PM - 6:00 AM. If no IDS alerts occur in this window, but the signature is known to be correct, this would be an example of what?
Show answer and explanation
Correct answer: A. A True Negative.
A True Negative occurs when an alert should not fire and it does not fire. Since no logins occurred during the monitored window (6:00 PM - 6:00 AM) and no alerts were generated, the detection correctly identified the absence of malicious activity.
Why the other options are wrong
- B. A True Positive occurs when malicious activity is detected and an alert fires.
- C. A False Negative occurs when malicious activity exists but no alert is generated.
- D. A False Positive occurs when an alert fires but no malicious activity actually occurred.
Question 33
A Cyber Threat Intelligence (CTI) team delivers a briefing to the CISO detailing their view of the threat landscape the organization faces. This is an example of what type of Threat Intelligence?
Show answer and explanation
Correct answer: B. Strategic
Strategic threat intelligence provides high-level briefings about the overall threat landscape, organizational risk, and long-term trends affecting the business. When a CTI team delivers a briefing to the CISO about the organization's threat landscape, they are providing strategic-level intelligence that informs executive decision-making and organizational security posture.
Why the other options are wrong
- A. Tactical intelligence focuses on technical indicators, attack methods, and tools used by threat actors, not broad threat landscape overviews.
- C. Operational intelligence addresses specific adversary activities, campaigns, and infrastructure but is more detailed than landscape briefings.
- D. Executive is not a standard tier of threat intelligence classification; strategic is the appropriate category for briefings to senior leadership.
That was 33 of 131.
The full Splunk SPLK-5001 pack has all 131 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 65 free as one PDF by email. Get the Half Pack →