10 free Splunk SPLK-5002 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 102 questions. Work through them, then open each answer to check your reasoning.
Get all 102 questions (US$39) · Download these 10 as a PDF
Question 1
Which of the following is a reason to utilize ES risk framework as a part of detection building?
Show answer and explanation
Correct answer: D. Help prioritize security findings based on their potential business impact.
The ES (Enterprise Security) risk framework is fundamentally designed to prioritize security findings and alerts based on their potential business impact. It uses risk scoring to help security teams focus on the most critical threats to the organization. This prioritization allows teams to allocate resources effectively and address the highest-risk items first.
Why the other options are wrong
- A. While threat intelligence is important, creating a feedback loop to identify insider threats is not the primary purpose of the ES risk framework.
- B. The ES risk framework does not accelerate detection runtime; it operates on findings after detection and focuses on prioritization rather than performance optimization.
- C. Simplifying SOAR automation is not a function of the ES risk framework; that relates to workflow design and platform configuration.
Question 2
When creating a case in Splunk SOAR, which action should be taken to correlate various findings (risk notables) to ensure all are actioned?
Show answer and explanation
Correct answer: D. Search Splunk Enterprise Security for all related events based on key fields in a risk notable and select how to process the results to decide which events to merge into the current investigation.
When creating a case in Splunk SOAR to correlate various findings (risk notables), the correct approach is to search Enterprise Security for all related events based on key fields in the risk notable and then select how to process the results to decide which events to merge. This gives the analyst control over the correlation logic and allows intelligent consolidation of related findings into a single investigation.
Why the other options are wrong
- A. This option references 'threat_object' field which is not the correct field name for correlation in this context.
- B. While this mentions searching for related events, it uses 'threat_object' instead of 'key fields,' which is imprecise and not the standard approach.
- C. This option uses 'risk_object' field, which is not the correct field for correlating findings in Splunk SOAR case creation workflows.
Question 3
Consider the following series of events:4:00 GMT Detection runs for interval 3:3-:004:30 GMT Detection runs for interval 4:00-4:304:35 GMT Event 1 occurs on an endpoint4:45 GMT Event 1 is indexed5:00 GMT Detection runs for interval 4:3-:005:05 GMT Event 1 finding is added to ES with timestamp 4:355:24 GMT Event 2 occurs on an endpoint5:30 GMT Detection runs for interval 5:00-5:305:35 GMT Event 2 is indexed6:00 GMT Detection runs for interval 5:30-6:00What is the problem with the detection schedule chosen and how can it be solved?
Show answer and explanation
Correct answer: B. The logs are delayed so the detection time window needs to be increased.
The problem illustrated is that Event 1 occurs at 4:35 GMT but is not indexed until 4:45 GMT (10-minute delay), yet the detection running at 5:00 GMT only covers the interval 4:30-5:00. However, the detection should have caught it because it was indexed by 4:45. The real issue is that the detection window is missing events that occur before indexing completes. To solve this, the detection time window needs to be increased to accommodate log ingestion delays, ensuring that events occurring in an earlier time window are still captured when the detection runs.
Why the other options are wrong
- A. A time window that is too large would cause duplicate alerts across overlapping detection runs, but the issue here is events being missed, not duplicates.
- C. A small time window causes missed events, not duplicates; this misidentifies both the problem and the direction of the solution.
- D. Decreasing the time window would worsen the problem of missed events due to indexing delays.
Question 4
An effective method for building automation workflows is to follow the OODA (Observe, Orient, Decide, Act) loop stages.
When transitioning between the Decide and Act stages, what additional work should be included before automating the Act stage?
Show answer and explanation
Correct answer: B. Validate if the asset, identity, or service has an exemption.
When transitioning from the Decide stage to the Act stage in automation workflows, it is critical to validate whether the asset, identity, or service has an exemption. This ensures that automated actions do not disrupt legitimate business operations or violate policy exceptions that have been previously approved. Checking exemptions is a necessary safeguard before executing automated responses.
Why the other options are wrong
- A. Creating a new response template is not a specific requirement for the Decide-to-Act transition; templates should exist prior to this decision point.
- C. While validating data paths is important, exemption checking is the critical step between Decide and Act to prevent inappropriate automation.
- D. Creating a new automation playbook should occur during the planning phase, not during the transition between Decide and Act stages.
Question 5
What is the best method to operationalize the results of a threat hunt for daily use by SOC analysts?
Show answer and explanation
Correct answer: C. Create detections based on the documented findings.
The best method to operationalize threat hunt results for daily SOC analyst use is to create detections based on the documented findings. This converts ad-hoc hunting discoveries into repeatable, automated processes that continuously monitor for similar threats in the environment. Detections allow the organization to scale the findings across all security monitoring infrastructure.
Why the other options are wrong
- A. Communicating findings is important for awareness but does not operationalize the results into ongoing security monitoring.
- B. Monthly reports document findings but do not operationalize them into actionable daily security processes.
- D. Communicating gaps to the architecture team may be a follow-up action but is not the primary operationalization method for hunt results.
Question 6
How can an engineer verify if results will return for a potential detection based on historical events within the organization?
Show answer and explanation
Correct answer: C. Run the detection against production data within the same Splunk instance.
To verify if a potential detection will return results based on historical events within an organization, an engineer should run the detection against production data within the same Splunk instance. This tests the detection logic against real organizational data, confirming that the detection will generate meaningful results from actual events that have occurred in the environment.
Why the other options are wrong
- A. Splunk Attack Range with Atomic Red Team injections tests synthetic attacks, not real historical organizational events.
- B. The constraint earliest=now latest=+24h looks forward in time and does not search historical data.
- D. The constraint earliest=0 latest=l (assuming 'l' is 'now') searches all historical data but the question asks specifically about verifying results with organizational data, making option C more direct and appropriate.
Question 7
Which of the following is not a type of metadata that can be returned by the metadata command?
Show answer and explanation
Correct answer: D. assets
The Splunk metadata command returns information about indexed data, including sourcetypes, hosts, and sources. However, 'assets' is not a type of metadata returned by the metadata command. Assets are typically entities managed through asset inventories or identity management systems, not through the Splunk metadata command.
Why the other options are wrong
- A. Sourcetypes are a standard metadata type returned by the metadata command.
- B. Hosts are a standard metadata type returned by the metadata command.
- C. Sources are a standard metadata type returned by the metadata command.
Question 8
MITRE D3FEND™ is designed to compliment MITRE's list of adversarial tactics, techniques, and common knowledge (ATT&CK®).
Which tactics are associated with MITRE D3FEND™ in order to detect, deny, and disrupt adversarial efforts?
Show answer and explanation
Correct answer: D. Harden, Detect, Isolate, Deceive, Evict
MITRE D3FEND defines defensive tactics designed to counter adversarial efforts using six categories: Harden, Detect, Isolate, Deceive, Evict, and additional defensive concepts. These tactics work together to detect, deny, and disrupt adversarial activities. Harden protects assets, Detect identifies threats, Isolate contains threats, Deceive confuses attackers, and Evict removes adversary presence.
Why the other options are wrong
- A. This option includes 'Exclude' and 'Eradicate' which are not part of the official MITRE D3FEND tactical framework.
- B. While this includes correct tactics like Harden, Detect, and Isolate, it is missing Deceive, which is a core D3FEND tactic, and incorrectly includes Disrupt.
- C. This option includes 'Exclude' and 'Define' which are not recognized MITRE D3FEND tactics.
Question 9
Below is an example of a sysmon process create log.
Which EventCode would be associated to this log entry?
Show answer and explanation
Correct answer: C. EventCode=1
This log entry documents a process creation event in Sysmon. The log contains process creation details including Image, CommandLine, CurrentDirectory, User, and parent process information. EventCode 1 in Sysmon specifically represents process creation events, capturing when a new process is instantiated on the system. The structured data showing the executable path (powershell.exe), command line arguments, and parent process chain are all characteristic fields of a process creation event.
Why the other options are wrong
- A. EventCode 4 represents Sysmon service state changed events, not process creation.
- B. EventCode 2 represents a change in process create time in Sysmon, not the initial process creation.
- D. EventCode 3 represents network connection events in Sysmon, not process creation events.
Question 10
Based on a recent red team exercise, an organization is highly concerned about pass the hash attacks especially including tools like Empire.
Which EventCode associated to PowerShell Script Block Logging would be used to detect this activity?
Show answer and explanation
Correct answer: D. EventCode=4104
EventCode 4104 is the PowerShell Script Block Logging event that captures executed script blocks. This event is specifically designed to detect suspicious PowerShell activity including pass-the-hash attacks and tools like Empire that rely on PowerShell for credential theft and lateral movement. Analyzing script blocks allows security teams to identify obfuscated code, credential extraction, and remote code execution patterns characteristic of these attacks.
Why the other options are wrong
- A. EventCode 4126 does not exist as a standard Windows event code for PowerShell monitoring.
- B. EventCode 4168 relates to credential validation and is not associated with PowerShell Script Block Logging.
- C. EventCode 4624 is a logon event that tracks successful authentications, not PowerShell script execution.
That was 10 of 102.
The full Splunk SPLK-5002 pack has all 102 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.