26 free Splunk SPLK-5002 practice questions from the CertStash pack of 102, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 26 free here, all 102 in the pack, and each step includes the one before it.
Get all 102 questions (US$39) · Download the first 10 as a PDF
Question 1
The threat-hunting team has identified suspicious activity. An analyst manually creates a notable event using an event action to track the activity. How should a detection engineer ensure this activity automatically produces findings in the future?
Show answer and explanation
Correct answer: B. Create a correlation search to produce notable events for the activity.
A correlation search is the appropriate Splunk mechanism for automatically generating notable events based on defined criteria. When an analyst manually creates a notable event, a detection engineer should formalize that detection pattern into a correlation search so that future matching activity automatically produces notable events without manual intervention. Correlation searches are the standard detection mechanism in Splunk Enterprise Security for converting search results into trackable, actionable notable events.
Why the other options are wrong
- A. SOAR playbooks handle automated response and investigation orchestration, not the initial creation of notable events from raw detections.
- C. Risk modifiers adjust risk scores for existing events but do not automatically generate new notable events from activity patterns.
- D. SOAR playbooks are for post-detection automation and response, not for the primary detection and notable event generation process.
Question 2
A detection engineer is using a threat defense informed strategy to define use cases. Which Splunk app would best facilitate their use case development process by cross referencing detections with the MITRE ATT&CK® Framework?
Show answer and explanation
Correct answer: B. Splunk Security Essentials App
The Splunk Security Essentials App is purpose-built to facilitate use case development by mapping detections to the MITRE ATT&CK Framework. It provides a structured approach for threat-defense-informed strategy by allowing detection engineers to cross-reference their use cases with ATT&CK tactics and techniques, enabling alignment of detection efforts with known adversary behaviors.
Why the other options are wrong
- A. The Supporting add-on for MITRE ATT&CK provides framework data but is not designed as the primary tool for use case development and cross-referencing.
- C. Enterprise Security is a comprehensive platform but is not specifically optimized for use case development with MITRE ATT&CK framework mapping.
- D. The Enterprise Security Content Update App provides content updates but is not the primary tool for use case development and framework alignment.
Question 3
What can an engineer use to capture contextual values from a dashboard and create a drilldown to link to a new search?
Show answer and explanation
Correct answer: A. Tokens
Tokens are Splunk's mechanism for capturing and passing contextual values within and between dashboards. They enable dynamic drilldowns by allowing a dashboard to capture user selections or search results and pass those values to linked searches, creating interactive dashboard-to-search workflows.
Why the other options are wrong
- B. JSON is a data format and cannot capture contextual values from dashboard interactions.
- C. Aliases are naming conventions for fields and do not enable value capture or drilldown functionality.
- D. Environment variables are system-level settings and are not used for capturing dashboard context or creating drilldowns.
Question 4
In a contextualization playbook, a URL is transmitted to a sandbox for examination and disposition recommendation. What underlying HTTP method is used to transmit this data to the sandbox?
Show answer and explanation
Correct answer: B. POST
POST is the standard HTTP method for transmitting data to a server, including sending URLs to a sandbox for examination and disposition recommendation. POST requests include the data in the request body, making it appropriate for submitting information for processing.
Why the other options are wrong
- A. PUT is used to update existing resources on a server, not to submit data for processing.
- C. GET is used to retrieve data from a server and should not be used to transmit sensitive information like URLs for sandbox analysis.
- D. STOR is not a standard HTTP method.
Question 5
What provides consistency for data mapping applied to data model and saved search exports between Splunk Enterprise Security and Splunk SOAR?
Show answer and explanation
Correct answer: B. Global field mappings
Global field mappings provide the consistency required for data mapping applied to data models and saved search exports between Splunk Enterprise Security and Splunk SOAR. These mappings ensure that fields are consistently interpreted across both platforms.
Why the other options are wrong
- A. Global field aliases create alternative names for fields but do not provide the structured mapping consistency needed for data model exports.
- C. Field labels are display names for fields and do not control the underlying data mapping consistency.
- D. Field aliases create alternative field names but are less comprehensive than global field mappings for ensuring cross-platform consistency.
Question 6
Which tool can help provide a baseline of the data sources in a given Splunk environment?
Show answer and explanation
Correct answer: D. Splunk Security Essentials Data Inventory
Splunk Security Essentials Data Inventory provides a comprehensive baseline of data sources available in a given Splunk environment, helping organizations understand what data is available and how it can be used for security analytics.
Why the other options are wrong
- A. Enterprise Security Content Update provides updated detection content but is not designed to inventory baseline data sources.
- B. Enterprise Security Data Library documents data sources used in detections but is not the primary tool for establishing a baseline inventory.
- C. Splunk Security Essentials Analytic Stories provide detection logic and context but are not designed to catalog available data sources.
Question 7
An engineer is writing a correlation search and wants to use T1027 from MITRE ATT&CK® as a field in Incident Review.Assuming they are writing a correlation search that does not use the Risk data model, what example statement should be appended at the end of their correlation search?
Show answer and explanation
Correct answer: A. | eval annotations.mitre_attack.mitre_technique_id="T1027"
The correct syntax for appending MITRE ATT&CK technique IDs to a correlation search is using eval with the annotations.mitre_attack.mitre_technique_id field path. This creates the proper annotation structure that Incident Review recognizes for displaying technique information.
Why the other options are wrong
- B. The set command is not appropriate for creating field values in Splunk searches; eval is the correct command.
- C. The field path should use annotations, not field, and the command should be eval, not set.
- D. While eval is correct, the field path should be annotations.mitre_attack.mitre_technique_id, not field.mitre_attack.mitre_technique_id.
Question 8
An automation engineer for the Wonderland SOC, has configured a new asset and is getting an HTTP 403 response code. Which of the following is the possible cause of this error code?
Show answer and explanation
Correct answer: B. Asset credentials don't have adequate permissions.
HTTP 403 Forbidden indicates that the server understood the request but refused to authorize it. This occurs when credentials lack the necessary permissions to access the endpoint, even if the username and password are correct.
Why the other options are wrong
- A. Token authentication issues typically result in 401 Unauthorized or 403 Forbidden depending on implementation, but the primary cause of 403 is insufficient permissions.
- C. A non-existent endpoint returns HTTP 404 Not Found, not 403 Forbidden.
- D. Incorrect username or password returns HTTP 401 Unauthorized, not 403 Forbidden.
Question 9
Which of the following is a methodology to help prevent malicious lateral movement?
Show answer and explanation
Correct answer: B. Zero Trust
Zero Trust is a security methodology that prevents malicious lateral movement by requiring continuous verification of all users and devices, assuming no implicit trust regardless of network location. This contrasts with traditional perimeter-based security.
Why the other options are wrong
- A. MITRE ATT&CK is a knowledge base for documenting adversary tactics and techniques, not a methodology for preventing lateral movement.
- C. The Lockheed Martin Cyber Kill Chain is a framework for understanding attack stages, not a methodology specifically designed to prevent lateral movement.
- D. Breakglass is an emergency access procedure, not a methodology for preventing lateral movement.
Question 10
How does Mission Control decipher which response template to assign to findings?
Show answer and explanation
Correct answer: B. Response templates are assigned to specific incident types.
Mission Control assigns response templates to findings based on incident types. When a finding is classified with a specific incident type, the corresponding response template configured for that incident type is automatically applied.
Why the other options are wrong
- A. While detections in ES can have metadata, response templates in Mission Control are assigned through incident type configuration, not carried over from detection creation.
- C. Response templates can be configured directly in Mission Control without requiring SOAR configuration.
- D. Mission Control uses deterministic incident type matching to assign response templates, not AI-based deduction.
What people say about the full SPLK-5002 pack 5.0 from 4
Purchased SPLK-5002 exam questions for my brother, he passed his exam today. So great. Cheers.
Most of the SPLK-5002 questions were exactly what I saw on the exam. Cert Stash material is authentic and reliable.
I passed my SPLK-5002 exam with your valid questions, thanks so much.
Question 11
Which of the following is the most efficient search to return a list of all visible indexes and the sourcetypes contained within them?
Show answer and explanation
Correct answer: D. | tstats values(sourcetype) where index=* by index
The tstats command with the indexed fields data model is the most efficient approach because it operates on metadata rather than scanning raw events. Option D correctly uses tstats to return sourcetypes grouped by index without processing full event data. Option A scans all events unnecessarily. Option B also processes raw events instead of metadata. Option C has incorrect syntax with index=true.
Why the other options are wrong
- A. Scanning index=* processes all raw events, which is inefficient for metadata queries.
- B. Requires sourcetype=* which processes events unnecessarily before aggregating.
- C. The syntax index=true is incorrect and does not properly filter index metadata.
Question 12
What field is used by default to direct data into CIM data model datasets?
Show answer and explanation
Correct answer: B. tag
The tag field is used by default to direct data into CIM data model datasets. Tags are applied to event data and serve as the primary mechanism for routing events to the appropriate CIM datasets based on their classification (e.g., tag=network, tag=authentication, tag=malware).
Why the other options are wrong
- A. sourcetype is used for data classification but is not the default field for directing data into CIM datasets.
- C. dataset is not a standard field used for routing data into CIM data models.
- D. source identifies the data origin but is not used for directing data into CIM datasets.
Question 13
Which tool can help identify known tactics, techniques, and procedures that a threat group is most likely to use when targeting a financial organization?
Show answer and explanation
Correct answer: C. The MITRE ATT&CK® matrix's industry heatmap in Splunk Security Essentials
The MITRE ATT&CK matrix's industry heatmap in Splunk Security Essentials displays tactics and techniques most commonly used against specific industries, including financial organizations. This allows threat hunters to identify likely threat group behaviors for their sector. Option A references Lockheed Martin Kill Chain which is less industry-specific. Option B mentions an incorrect application (Mission Control instead of Security Essentials). Option D is a general threat intelligence tool without industry-specific ATT&CK analysis.
Why the other options are wrong
- A. The Cyber Kill Chain provides a different framework and lacks industry-specific targeting data.
- B. Mission Control and the Incident Review page do not provide ATT&CK industry heatmaps.
- D. Threat Intelligence Management is a data source tool, not an ATT&CK analysis framework.
Question 14
When creating a case in Splunk SOAR, which action should be taken to correlate various findings (risk notables) to ensure all are actioned?
Show answer and explanation
Correct answer: D. Search Splunk Enterprise Security for all related events based on key fields in a risk notable and select how to process the results to decide which events to merge into the current investigation.
When creating a case in Splunk SOAR to correlate risk notables, the correct approach is to search Enterprise Security for all related events based on key fields in a risk notable and then select how to process the results to decide which events to merge into the current investigation. This allows analysts to manually evaluate correlations and make informed decisions about which findings belong together, ensuring comprehensive case management.
Why the other options are wrong
- A. The threat_object field is not the standard field used for correlation in this context.
- B. While the search process is similar, this option does not specifically reference risk notables as the starting point.
- C. The risk_object field is not the correct field name for this correlation process in Splunk ES.
Question 15
Which of the following should an engineer do as they evaluate their Threat Detection and Incident Response lifecycle?
Show answer and explanation
Correct answer: A. Evaluate the threat process lifecycle based on contextual business and industry knowledge.
When evaluating the Threat Detection and Incident Response lifecycle, engineers should assess the threat process lifecycle through the lens of contextual business and industry knowledge. This ensures detection and response strategies align with organizational risk tolerance and operational environment. Option B confuses ATT&CK framework use with risk appetite. Option C prioritizes less impactful threats, which is strategically incorrect. Option D bases evaluation on financial metrics rather than security effectiveness.
Why the other options are wrong
- B. The MITRE ATT&CK framework describes threat behaviors, not organizational risk appetite.
- C. Resources should focus on high-impact threats, not the least impactful vectors.
- D. TDIR lifecycle decisions should prioritize security effectiveness over profit margins.
Question 16
For detections that leverage a CIM data model, which aspect of the configuration is responsible for determining which indexes are being searched?
Show answer and explanation
Correct answer: D. The data model's constraint macro.
The data model's constraint macro determines which indexes are searched when a detection leverages a CIM data model. Constraint macros are used to filter and scope the data model searches to specific indexes.
Why the other options are wrong
- A. The data model's eval expression performs calculations and field transformations but does not determine which indexes are searched.
- B. The data model's dataset hierarchy defines the structure and relationships between datasets but does not control index selection.
- C. Data models do not have an explicit index list; index selection is controlled through constraint macros.
Question 17
When creating a detection that searches user activity across CIM-compliant data, which CIM field should be reviewed to ensure that data is aggregated appropriately?
Show answer and explanation
Correct answer: D. user
The 'user' field is the standard CIM field for user identity that should be reviewed to ensure proper data aggregation. This field is consistently used across CIM-compliant datasets for user activity. Option A uses 'userid' which is not standard CIM. Option B 'identity' is too broad. Option C 'srcUser' is specific to network data sources and doesn't cover all user activity contexts.
Why the other options are wrong
- A. userid is not the standard CIM field for user identification.
- B. identity is broader than user-specific activity and not CIM-standardized for this purpose.
- C. srcUser is specific to network/authentication contexts and doesn't generalize across CIM.
Question 18
An engineer wants to track and report on all authentication to corporate assets, and wants to prioritize critical assets without significantly increasing the number of findings (notable events) generated. What process could be used to accomplish this goal?
Show answer and explanation
Correct answer: C. Add all access attempts to the Risk Index, and increase the Criticality of the critical assets.
Adding all access attempts to the Risk Index with increased Criticality assigned to critical assets allows tracking of all authentication while prioritizing critical assets without generating additional findings. The Risk Index consolidates risk signals and allows filtering by asset criticality. Option A would generate the same number of findings across all assets. Option B reduces noise but loses visibility on critical assets. Option D focuses only on data modeling rather than risk tracking.
Why the other options are wrong
- A. Increasing Risk Factor still generates findings for all assets without consolidation.
- B. This reduces findings but loses visibility into critical asset access patterns.
- D. Adding to the data model doesn't achieve risk prioritization or tracking of findings.
Question 19
What is the best method to operationalize the results of a threat hunt for daily use by SOC analysts?
Show answer and explanation
Correct answer: C. Create detections based on the documented findings.
The best method to operationalize threat hunt results for daily SOC use is to create detections based on the documented findings. This transforms hunt discoveries into repeatable, automated processes that the SOC can leverage continuously, enabling the organization to systematically detect similar threats without requiring manual hunting efforts. Detections convert one-time findings into permanent defensive capabilities.
Why the other options are wrong
- A. Communicating findings alone does not operationalize them for daily use; it is a preliminary step.
- B. Monthly reporting is a passive documentation mechanism and does not enable SOC analysts to operationalize findings in their daily work.
- D. Communicating gaps to architecture is useful for infrastructure improvement but does not operationalize hunt results for daily detection.
Question 20
In a Risk-Based Alerting implementation with Splunk Enterprise Security, which of the following best describes a risk factor?
Show answer and explanation
Correct answer: B. A multiplier of risk that depends on the characteristics of the specific user or asset.
A risk factor in Risk-Based Alerting is a multiplier that adjusts risk scoring based on specific characteristics of the user or asset involved in an event. Risk factors allow organizations to apply context-aware weighting, for example, a risky event involving a privileged user or critical asset receives higher risk scores than the same event involving a standard user.
Why the other options are wrong
- A. SOAR actions and annotations are separate orchestration and documentation features; they do not define risk factors.
- C. Risk factors are not tools for data model acceleration; they are scoring components.
- D. While risk factors do relate to events, they are not events themselves but rather multipliers applied to risk scores based on user or asset characteristics.
Question 21
An effective method for building automation workflows is to follow the OODA (Observe, Orient, Decide, Act) loop stages. When transitioning between the Decide and Act stages, what additional work should be included before automating the Act stage?
Show answer and explanation
Correct answer: B. Validate if the asset, identity, or service has an exemption.
When transitioning from the Decide stage to the Act stage of the OODA loop, the critical validation step is to check whether the asset, identity, or service has an exemption. This prevents automated actions from incorrectly targeting assets that should be excluded due to business requirements, compliance rules, or operational exceptions, ensuring automation operates safely and appropriately.
Why the other options are wrong
- A. Creating a new response template is a detection development activity, not a pre-automation validation step.
- C. While data validation is important, validating response data paths is not the specific exemption check needed before automating the Act stage.
- D. Creating a new automation playbook is the automation task itself, not the validation work that should precede it.
Question 22
Which Splunk Enterprise Security add-on facilitates the ingestion of Threat Intelligence data?
Show answer and explanation
Correct answer: D. SA-ThreatIntelligence
In Splunk Enterprise Security, the SA-ThreatIntelligence supporting add-on handles threat intelligence. It downloads, parses and stores threat intel feeds in the threat collections and drives threat matching. The other names are not the ES threat intelligence framework.
Why the other options are wrong
- A. TA-ThreatIntel is not a component of Splunk Enterprise Security.
- B. SA-ESSIntel is not the add-on that ingests threat intelligence in Enterprise Security.
- C. ESSIntel is not a real Enterprise Security add-on name.
Question 23
Consider the following series of events:4:00 GMT Detection runs for interval 3:30-4:004:30 GMT Detection runs for interval 4:00-4:304:35 GMT Event 1 occurs on an endpoint4:45 GMT Event 1 is indexed5:00 GMT Detection runs for interval 4:30-5:005:05 GMT Event 1 finding is added to ES with timestamp 4:355:24 GMT Event 2 occurs on an endpoint5:30 GMT Detection runs for interval 5:00-5:305:35 GMT Event 2 is indexed6:00 GMT Detection runs for interval 5:30-6:00What is the problem with the detection schedule chosen and how can it be solved?
Show answer and explanation
Correct answer: B. The logs are delayed so the detection time window needs to be increased.
The problem demonstrated in this scenario is that Event 1 occurs at 4:35 GMT but is not indexed until 4:45 GMT, a 10-minute delay. The detection window running at 5:00 GMT only covers 4:30-5:00, which would catch the indexed event. However, this tight scheduling creates risk of missing events with similar delays. The solution is to increase the detection time window to accommodate log ingestion delays, ensuring all delayed events are captured before the detection runs.
Why the other options are wrong
- A. The time window is not causing duplicates; it is too small to account for ingestion delays.
- C. A smaller time window would worsen the problem by missing more delayed events.
- D. Decreasing the time window would fail to capture delayed logs, not solve the problem.
Question 24
Which of the following is not a type of metadata that can be returned by the metadata command?
Show answer and explanation
Correct answer: D. assets
The metadata command in Splunk returns information about sourcetypes, hosts, and sources, three key metadata dimensions that help users understand data organization and characteristics. Assets, by contrast, are entities defined in asset and identity lookups or frameworks, not metadata returned directly by the metadata command itself.
Why the other options are wrong
- A. The metadata command can return sourcetype metadata.
- B. The metadata command can return host metadata.
- C. The metadata command can return source metadata.
Question 25
Which fields are used to determine asset priority, when priority is assigned through an asset and identity lookup?
Show answer and explanation
Correct answer: A. dest, src, or dvc
When asset priority is assigned through an asset and identity lookup in Enterprise Security, the system uses destination, source, or device fields (dest, src, or dvc) to match against the asset database. These fields identify which physical or logical asset is involved in an event, allowing the system to retrieve the asset's configured priority level from the lookup table.
Why the other options are wrong
- B. dest_user and src_user are user identity fields, not asset identifiers; user priority would be determined through identity lookups, not asset lookups.
- C. user and src_user are identity fields used for user-based priority assignment, not asset-based priority assignment.
- D. tag is a metadata field that categorizes events, not an asset identifier used to look up asset priority.
Question 26
A SOC's Incident Response Standard Operating Procedure (SOP) calls for any phishing emails containing files to be detonated in Splunk Attack Analyzer for evaluation. Which of the following can an engineer implement to gain efficiency through automation?
Show answer and explanation
Correct answer: D. Use a SOAR playbook to handle the Splunk Attack Analyzer submission and data collection steps, and make this information available to an assigned analyst.
SOAR (Security Orchestration, Automation and Response) playbooks are designed to automate complex, multi-step workflows. The SOP requires phishing emails with files to be detonated in Splunk Attack Analyzer, which is a specific technical action. A SOAR playbook can automatically handle the submission to Splunk Attack Analyzer, collect the analysis results, and present them to an assigned analyst, eliminating manual steps and improving efficiency while maintaining proper analyst oversight and disposition tracking.
Why the other options are wrong
- A. Email notifications alone do not automate the detonation requirement; this only creates a notification without executing the required action.
- B. PhishTank is a community phishing database and is not the appropriate tool for detonating files; the SOP specifically calls for Splunk Attack Analyzer.
- C. Simply assigning to analysts does not automate the Splunk Attack Analyzer submission step; the analyst would still need to manually perform this action.
That was 26 of 102.
The full Splunk SPLK-5002 pack has all 102 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 51 free as one PDF by email. Get the Half Pack →