30 free Splunk SPLK-5003 practice questions from the CertStash pack of 120, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 30 free here, all 120 in the pack, and each step includes the one before it.
Get all 120 questions (US$39) · Download the first 10 as a PDF
Question 1
Sophia manages data ingestion for her organization’s SIEM. The data science team wants to perform real-time analytics on security data and asks Sophia for a copy of all new endpoint telemetry from the current point forward. The SIEM currently collects 15TB of endpoint telemetry every day. Which of the following solutions can Sophia use to best help the data science team?
Show answer and explanation
Correct answer: B. Use a message bus to send data to both the SIEM and data science team.
The data science team wants every new endpoint event from now on, for real-time analytics, and the volume is 15TB per day. A message bus such as Apache Kafka sits between the data sources and the consumers, so the same stream can be delivered to the SIEM and to the data science platform at the same time. Each consumer reads the data independently and at its own pace, the SIEM carries no extra export or search load, and the data scientists receive events as they arrive rather than in delayed batches. This is the standard pipeline pattern for feeding one high-volume stream to several destinations.
Why the other options are wrong
- A. Exporting the last 12 months is a one-time historical extract, while the team asked for new telemetry from the current point forward, and changing the schema to OCSF does not make it a live feed.
- C. A JSON export of the last 12 months is a one-time historical extract that provides no continuous feed of new telemetry for real-time analytics.
- D. A nightly CSV report delivers data up to a day late, which rules out real-time analytics, and exporting 15TB a day through SIEM reports would put heavy load on the SIEM.
Question 2
To ensure leadership is aware of the security team’s performance, which measurements should be presented on a regular basis? (Choose all that apply.)
Show answer and explanation
Correct answer: A, B, D. Patch compliance percentage; Mean time to contain; Mean time to respond
Leadership needs a small set of outcome metrics that show how well the security team reduces risk. Patch compliance percentage shows how much of the environment is protected against known vulnerabilities and how well the remediation program keeps pace. Mean time to contain shows how quickly the team stops an incident from spreading once it is identified, which limits damage. Mean time to respond shows how quickly the team acts on detected threats from start to finish. All three can be trended over time and compared against targets, so leadership can see whether performance is improving and where investment is needed.
Why the other options are wrong
- C. The number of emergency change requests reflects change management activity across IT, so it does not measure how effectively the security team protects the organization or handles incidents.
Question 3
Justin has just finished successfully importing data from the CMDB platform into the SIEM. While validating data, he discovers a host with a MAC address (35:33:33:20:76) that does not have the same OUI (03:83:71) as the rest of the deployed devices. Which of the following is the most likely explanation for this discrepancy?
Show answer and explanation
Correct answer: A. CMDB contains data from personal devices managed under MDM
The organizationally unique identifier (OUI) in the first part of a MAC address identifies the hardware manufacturer. When every corporate device shares one OUI, the organization most likely buys its hardware from a single vendor, so a host with a different OUI is most likely hardware the company did not purchase. Personal devices enrolled in mobile device management (MDM) under a bring-your-own-device program are recorded in the CMDB alongside corporate assets, yet they come from many different manufacturers. That makes them the most likely explanation for one record that does not match the standard OUI.
Why the other options are wrong
- B. Normalization changes field names and formats, such as separators or letter case, but it does not replace the manufacturer prefix of a MAC address.
- C. The import completed successfully and only one host differs from the standard OUI, so export corruption is a less likely cause than a legitimately different device.
- D. VPN pools assign IP addresses to remote clients, and a CMDB records managed assets, so VPN pool addresses would not explain a hardware MAC address with a different OUI.
Question 4
Which of the following are common criteria used for the evaluation of threat intelligence feeds? (Choose all that apply.)
Show answer and explanation
Correct answer: A, C, D. TLP; Source; Severity
When an organization evaluates threat intelligence feeds, it looks at how the data can be used, how far it can be trusted and how much it matters. The Traffic Light Protocol (TLP) marking defines how widely the intelligence may be shared, for example whether it can go to partners and other organizations or must stay within the organization. The source tells the team who produced the intelligence and how reliable that provider has been. Severity indicates how serious the threat behind the indicators is, which helps the team prioritize what to act on and decide whether the feed adds value to detection and response.
Why the other options are wrong
- B. Industry describes the organization or sector a feed targets, which is a general label rather than a criterion for judging the quality, reliability or handling of the intelligence.
Question 5
Which MLTK command can be combined with tstats in an ES detection to apply a machine learning model to search results?
Show answer and explanation
Correct answer: B. Fit
In the Splunk Machine Learning Toolkit (MLTK), the fit command trains a model on the search results passed to it, applies that model to the same results and appends the output columns, such as predictions or outlier flags, to the events in the search pipeline. Because fit works on any tabular results, a detection in Splunk Enterprise Security can use tstats to summarize data quickly from accelerated data models and then pipe those results into fit, for example with an algorithm such as DensityFunction, to flag anomalous values. The companion apply command reuses a saved model on new results.
Why the other options are wrong
- A. The MLTK summary command returns information about a saved model, such as its settings or coefficients, and does not apply a model to search results.
- C. Cluster is a core SPL command that groups events with similar text, not an MLTK command for training or applying a machine learning model.
- D. The sample command randomly samples or partitions events, which reduces or splits the data but does not apply a machine learning model to it.
Question 6
An architect is planning for a net new SIEM deployment. Which of the following data sources will provide the most immediate security value?
Show answer and explanation
Correct answer: D. Security tool alerts
Alerts from existing security tools, such as endpoint detection and response, firewalls, intrusion detection systems and email security gateways, are already the output of detection logic. Once they are in the new SIEM, analysts can triage, correlate and investigate them immediately, without writing and tuning new detections first. They also give a central view across tools that previously had to be watched separately. Other data sources add valuable context and support custom detections later, but security tool alerts deliver security value from the first day of the deployment, which makes them the right place to start.
Why the other options are wrong
- A. Physical access control logs cover badge activity, which supports some insider and physical security use cases but rarely provides immediate value for detecting cyber threats.
- B. Active Directory logs provide raw authentication and account activity that needs detections to be written and tuned before it produces findings, so its value is not immediate.
- C. CMDB data describes assets and owners, which enriches other events with context but does not detect threats on its own.
Question 7
How can a threat intelligence team discover additional Indicators Of Compromise (IOCs) from threat actor payloads?
Show answer and explanation
Correct answer: D. Submit the payload to Splunk Attack Analyzer.
Splunk Attack Analyzer automatically analyzes suspicious files and URLs, such as threat actor payloads and phishing links, by detonating them in a sandbox environment and following the attack chain. During the analysis it records the behavior of the payload and extracts artifacts such as additional URLs, domains, IP addresses, dropped files and hashes. These become new indicators of compromise (IOCs) that the threat intelligence team can use for hunting, blocking and detection. Submitting payloads to Splunk Attack Analyzer is therefore the way to discover IOCs that were not known from the original sample alone.
Why the other options are wrong
- A. Splunk Intelligence Management collects, normalizes and distributes threat intelligence from feeds and sharing groups, but it does not detonate payloads to extract new indicators.
- B. Mission Control is a unified work surface for SOC analysts to manage and respond to incidents, not a tool for analyzing malware payloads.
- C. Behavioral Analytics detects anomalous user and entity behavior from event data and does not analyze submitted payload files.
Question 8
Which of the following is the most direct way to measure a detection engineering practice to understand what gaps may exist in security controls and program effectiveness?
Show answer and explanation
Correct answer: C. Measure security control coverage against industry frameworks and organizational risks.
Gaps can only be found by comparing what the detections cover against what they should cover. Mapping detections and security controls to an industry framework such as MITRE ATT&CK, and to the risks and threats the organization has identified, shows which techniques, data sources and risk scenarios have detections and which have none. The uncovered areas are the gaps, and the coverage level shows how complete the program is. This makes coverage measurement the most direct way to understand where security controls and the detection engineering practice fall short, and where to invest next.
Why the other options are wrong
- A. Mean Time to Detect (MTTD) measures how quickly existing detections fire, so it says nothing about threats that have no detection at all.
- B. A count of true positive alerts measures the output of detections that already exist and cannot reveal threats that no detection covers.
- D. The number of detections created per quarter measures engineering output, and many new detections may still cover the same areas while leaving gaps elsewhere.
Question 9
Buttercup Games has implemented over 100 detections in their SOC. These detections consist mostly of vendor provided signatures and field matching that have been tuned, with a few that have been custom built. What more advanced detection methods should they deploy?
Show answer and explanation
Correct answer: C. Use an outlier based algorithm
Vendor signatures and field matching are rule-based methods that only find activity someone has already described. A more advanced step is behavioral detection with outlier-based algorithms, which first build a baseline of normal activity for users, hosts or other entities and then flag values that deviate from it. In Splunk this can be done with the Splunk Machine Learning Toolkit (MLTK) or with statistical searches. Outlier detection can surface unknown or novel threats, such as unusual data transfer volumes or abnormal login behavior, that no signature describes, which moves the SOC beyond its current signature-driven content.
Why the other options are wrong
- A. A static threshold is a fixed rule that fires when a count passes a set value, which is a basic method at the same level as the existing signatures.
- B. Asset and identity enrichment adds context to alerts for prioritization and investigation, but it is not a detection method in its own right.
- D. Automation that pulls additional data supports investigation and response after an alert, rather than providing a new way to detect threats.
Question 10
What strategies enable data-driven approaches to evaluating tool efficacy? (Choose all that apply.)
Show answer and explanation
Correct answer: A, C, D. Clearly defined outcomes and success criteria; Early identification of prioritized requirements and use cases; Continuous operational monitoring and metrics collection
A data-driven evaluation measures a tool against evidence gathered in the organization's own environment. Clearly defined outcomes and success criteria set measurable targets, such as detection rates or analyst time saved, so results can be compared objectively. Early identification of prioritized requirements and use cases decides what will be tested and how much each capability matters, which keeps the evaluation focused on the organization's needs. Continuous operational monitoring and metrics collection gathers performance data once the tool is running, which shows whether it keeps delivering the expected value over time and supports renewal or replacement decisions.
Why the other options are wrong
- B. Public testimonials and vendor marketing materials are claims made by others about other environments, so they provide no measured evidence of how the tool performs for this organization.
Question 11
A new vulnerability has been announced in a software library. Leadership would like to understand what exposure this has caused. What can be used to determine which vendor provided executables use that library?
Show answer and explanation
Correct answer: D. Software Bill of Materials
A Software Bill of Materials (SBOM) is a formal, machine-readable inventory of the components that make up a piece of software, including third-party libraries and their versions. When vendors supply SBOMs for their products, the organization can search them for the affected library and version and quickly list every vendor executable that contains it. This answers leadership's exposure question directly, even for software whose source code the organization never sees, and it supports prioritizing patches and vendor follow-up.
Why the other options are wrong
- A. A Git file list shows files in a source repository the organization controls, and vendor executables are not built from the organization's repositories.
- B. Vulnerability scan results report findings the scanner already knows how to detect and do not provide an inventory of the libraries inside each vendor executable.
- C. Release notes describe changes in a version and do not reliably list every library a product contains.
Question 12
A corporate cybersecurity team operating within the retail sector finds that its existing cyber threat intelligence (CTI) feeds are noisy and lack relevance to the environment. What type of CTI provider feed, shared among other retail organizations, should they consider to improve their CTI effectiveness?
Show answer and explanation
Correct answer: C. Industry ISAC
An Information Sharing and Analysis Center (ISAC) is a member organization for a particular sector, such as the Retail and Hospitality ISAC for retail companies. Members share indicators, attack reports and analysis about threats they are seeing, so the intelligence reflects the actors, fraud schemes and techniques that target that industry. For a retail security team whose current feeds are noisy and generic, an industry ISAC feed raises relevance because it comes from peers facing the same threats, which helps the team focus detections and hunting on what matters to its environment.
Why the other options are wrong
- A. Open source feeds are broad and general purpose, so they tend to add the kind of noise the team is trying to reduce.
- B. STIX and TAXII are a data format and a transport protocol for exchanging threat intelligence, not a provider of sector-specific intelligence.
- D. Internal intelligence comes from the organization's own data and is not a feed shared among other retail organizations.
Question 13
Which combination of practices and technologies most effectively creates a scalable, secure “paved road” for cloud-native application development?
Show answer and explanation
Correct answer: A. Using Open Policy Agent (OPA) for policy-as-code enforcement, maintaining versioned architecture blueprints, and creating standardized CI/CD pipeline templates which require vault service usage.
A paved road works when the secure way is also the easiest and is enforced automatically. Open Policy Agent (OPA) expresses security rules as policy as code, so they are checked the same way in every pipeline and cluster. Versioned architecture blueprints give teams approved, repeatable designs that can evolve under change control. Standardized CI/CD pipeline templates that require the vault service make secure secret handling the default for every project. Together these provide enforced, consistent guardrails that scale across many teams instead of relying on advice or manual checks.
Why the other options are wrong
- B. Infrastructure as code templates and secret scanning help, but this option has no policy enforcement or standard pipelines, and it detects leaked secrets after the fact instead of making secure secret storage the default.
- C. Recommending scanners in documentation and letting each team choose its own enforcement produces inconsistent controls rather than a standard paved road.
- D. Guidelines on a wiki and manual peer review rely on people following advice and do not scale or enforce controls automatically.
Question 14
Which stage in the DevOps CI/CD pipeline is the most effective to generate an SBOM?
Show answer and explanation
Correct answer: A. During the build phase to capture all the dependencies as they are assembled
The build phase is when dependencies are resolved, downloaded and assembled into the artifact, so it is the point at which the exact components and versions in the software are known. Generating the Software Bill of Materials (SBOM) automatically as part of the build captures this inventory accurately for every release and stores it with the artifact. Later pipeline stages can then use it to check components for known vulnerabilities and license issues before the software moves forward toward production.
Why the other options are wrong
- B. User acceptance testing focuses on whether the application meets business needs, and generating the inventory there is later and less reliable than capturing it during the build.
- C. Waiting until production means vulnerable or unapproved components are discovered only after they are already deployed.
- D. During requirements gathering no code or dependencies exist yet, so there is nothing to inventory.
Question 15
In a DevSecOps workflow, what is the primary purpose of an automated security gate that detects critical vulnerabilities during a build or deployment?
Show answer and explanation
Correct answer: D. To ensure that only code meeting defined security standards is deployed to production, automatically failing the build or deployment if critical issues are found.
An automated security gate is a policy check in the CI/CD pipeline, such as static analysis, dependency scanning or container image scanning, with defined pass and fail criteria. When the scan finds a vulnerability that breaks the defined standard, such as a critical severity finding, the gate automatically fails the build or blocks the deployment, so the vulnerable code cannot reach production. The developer gets immediate feedback, fixes the issue and runs the pipeline again. This enforces security standards consistently on every change, without relying on someone remembering to check.
Why the other options are wrong
- A. Optional warnings that do not affect the build describe advisory scanning, which lets critical vulnerabilities reach production and therefore provides no gate.
- B. Automated gates complement manual audits and developer training, since scanners cannot find every flaw, such as business logic issues.
- C. A security gate enforces checks rather than bypassing them, and skipping checks to speed up releases defeats the purpose of DevSecOps.
Question 16
Camille is building the high-level architecture and organizational requirements for a SOC modernization and automation initiative. The organization would like to use Splunk SOAR as the foundation of its new vision and strategy. What are some of the primary objectives this initiative should seek to achieve?
Show answer and explanation
Correct answer: C. Reduced MTTD, Reduced MTTR, Reduced Alert Fatigue, Increased Analyst Productivity
Splunk SOAR is used to automate repetitive tasks and orchestrate actions across security tools, so a SOC modernization built on it should aim for faster and less burdensome operations. Automated enrichment and triage cut mean time to detect (MTTD), and automated containment and response steps cut mean time to respond (MTTR). Handling routine alerts automatically reduces the alert fatigue that wears down analysts, and freeing analysts from manual work increases their productivity so they can focus on complex investigations and threat hunting.
Why the other options are wrong
- A. An increased MTTR means slower response, which is the opposite of what a modernization and automation initiative sets out to achieve.
- B. Reducing the signal-to-noise ratio would mean less useful signal relative to noise, which is the opposite of the goal.
- D. Increasing MTTD and MTTR means slower detection and response, which defeats the purpose of the initiative.
Question 17
What data normalization standards should be used to enable a wider integration across Splunk’s security products? (Choose all that apply.)
Show answer and explanation
Correct answer: B, D. Open Cybersecurity Schema Framework (OCSF); Common Information Model (CIM)
Normalization maps data from many sources into common field names and structures so content works across products. The Common Information Model (CIM) is the Splunk normalization standard used by Splunk Enterprise Security and other Splunk apps, with data models such as Authentication, Network Traffic and Endpoint that detections and dashboards rely on. The Open Cybersecurity Schema Framework (OCSF) is an open, vendor-neutral schema that Splunk co-founded and supports, which helps security data move between Splunk products and third-party tools in a consistent format. Using both enables wider integration across Splunk's security portfolio.
Why the other options are wrong
- A. JSON is a data serialization format that carries any field names, so it does not define the common fields that normalization requires.
- C. ORC (Optimized Row Columnar) is a columnar storage file format used in big data systems, not a schema for normalizing security data.
Question 18
What is the most effective approach to ensure coordinated response and clear communication during a large-scale security incident?
Show answer and explanation
Correct answer: B. Assign an incident commander function and use defined processes and communication channels.
Large incidents involve many teams, such as security, IT operations, legal, communications and executives, and they need a single point of coordination. An incident commander owns the response, sets priorities, assigns tasks and makes decisions, while defined processes and communication channels make sure updates reach the right people at the right time. This structure prevents conflicting actions and duplicated work, keeps stakeholders informed, and matches incident response guidance such as NIST SP 800-61, which stresses clear roles and planned communication.
Why the other options are wrong
- A. Automated notifications can support communication, but they cannot make decisions, assign work or coordinate the many teams involved.
- C. Independent responses without central direction lead to duplicated effort, conflicting actions and an incomplete picture of the incident.
- D. Withholding communication until resolution leaves teams and stakeholders uninformed and can breach legal or contractual notification duties.
Question 19
When acquiring forensic artifacts, what is a critical step to ensure admissibility in court?
Show answer and explanation
Correct answer: A. Chain of custody
Chain of custody is the documented record of who collected each piece of evidence, when and how, and every person who handled, transferred or stored it afterward. Together with integrity checks such as hash values recorded at acquisition, this record shows that the evidence presented in court is the same evidence that was collected and has not been altered. NIST SP 800-61 calls for evidence to be handled with a clear chain of custody, and gaps in that record can lead a court to reject the evidence.
Why the other options are wrong
- B. Chain of authenticity is not a recognized evidence handling procedure, and authenticity is shown through the chain of custody.
- C. Chain of authority describes a line of command within an organization, not a record of how evidence was handled.
- D. Chain of artifacts is not a recognized forensic or legal procedure for establishing that evidence is admissible.
Question 20
How can an organization best improve its Mean Time to Respond (MTTR) metrics?
Show answer and explanation
Correct answer: B. Implement SOAR playbooks to automatically isolate infected endpoints.
Mean Time to Respond (MTTR) measures how long it takes to act on an incident once it is detected. Manual response requires an analyst to notice the alert, review it, find the endpoint and log in to the EDR console before isolating the host, which can take a long time. A Splunk SOAR playbook can isolate an infected endpoint through the EDR integration within seconds of the alert, while also gathering context and notifying responders. Automating this common containment action removes manual delays from every qualifying incident, which directly lowers MTTR across the SOC.
Why the other options are wrong
- A. Paging responders for low severity alerts adds noise and alert fatigue, which pulls them away from serious incidents and tends to slow response.
- C. Streaming data to a data lake supports long-term trend analysis but does not speed up the response to individual incidents.
- D. Emptying spam folders is routine mailbox housekeeping with no effect on how quickly the team responds to incidents.
Question 21
Which of the following tasks takes the largest portion of a data scientist’s time?
Show answer and explanation
Correct answer: B. Data cleaning and preparation
Surveys of data scientists consistently report that data cleaning and preparation takes the largest share of their time. Raw data is rarely ready for analysis, so it must be collected from different systems, joined, deduplicated, checked for missing or inconsistent values, normalized and transformed into features before any model can use it. In security, this means parsing logs, aligning field names and timestamps and removing noise. Models are only as good as the data they are trained on, so this preparation work is essential and usually outweighs the time spent on modeling itself.
Why the other options are wrong
- A. Building AI agents is a specialized activity that only some data scientists perform and is not where most of their time goes.
- C. Building ML infrastructure is mainly the work of ML and platform engineers rather than the core daily work of data scientists.
- D. Analysis and modeling depend on clean, prepared data, and surveys show they take less of a data scientist's time than preparation does.
Question 22
Britney is an architect designing a network security pattern for deployment across an organization. This will include major sites such as the corporate headquarters in New York and London, as well as smaller sites distributed across the globe. She is considering the requirements for firewalls, intrusion prevention systems, and content filtering systems. What factors does Britney need to address during the design phase to ensure scalability and repeatability across all sites? (Choose all that apply.)
Show answer and explanation
Correct answer: A, B. Function of device; Topological placement of device
A repeatable security pattern is defined by what each device does and where it sits in the topology, for example a firewall at the internet edge, an intrusion prevention system on an internal segment and content filtering on outbound web traffic. These two factors stay the same at a large headquarters in New York or London and at a small branch, so the same pattern can be applied everywhere and scaled up or down. Sizing and product choices can then vary per site without changing the design.
Why the other options are wrong
- C. The vendor is a procurement and implementation choice, and fixing it does not make the architecture pattern more scalable or repeatable.
- D. The model will vary with each site's size and traffic, so it is an implementation detail rather than a factor of the design pattern.
Question 23
What is a SBOM?
Show answer and explanation
Correct answer: A. A comprehensive list of components, libraries, and dependencies
A software bill of materials (SBOM) is a formal, machine-readable inventory of the components, libraries and dependencies that make up a piece of software, including open source and third-party packages and their versions. It lets an organization see what its software contains, so it can quickly find applications affected by a newly disclosed vulnerability in a library, assess supply chain risk and meet customer or regulatory requirements. Common SBOM formats include SPDX and CycloneDX, and SBOMs are a central part of software supply chain security in DevSecOps programs.
Why the other options are wrong
- B. Search heads, indexers and forwarders are Splunk deployment components, and a list of them is a deployment inventory, not a software bill of materials.
- C. Indicators, detections and alerts are security content and operational output, not the software components that make up an application.
- D. Searches, macros and reports are Splunk knowledge objects, not the libraries and dependencies listed in a software bill of materials.
Question 24
Buttercup Games needs to provide its SOC team access to a wide range of security data sources located across different regions and cloud providers. Which architectural solution allows the SOC analysts to query these data sources as a single logical source without having to migrate or copy all the raw data?
Show answer and explanation
Correct answer: D. Federated search
Federated search lets analysts run a query from one place against data that stays where it lives, in other deployments, regions or cloud storage, and see the results together. Splunk Federated Search follows this model: a search head can search remote Splunk deployments and supported external stores such as Amazon S3 without first ingesting or copying all of the raw data. For Buttercup Games this gives the SOC a single logical view across regions and cloud providers while avoiding the cost, delay and data residency issues of moving every data set into one central location.
Why the other options are wrong
- A. A data mesh is an organizational approach in which domain teams own and publish their data as products, and it does not by itself provide a single query layer over all sources.
- B. A message bus moves event streams between producers and consumers, so it transports data rather than letting analysts query data where it is stored.
- C. A centralized data warehouse requires extracting and loading the raw data into one store, which is the migration the requirement rules out.
Question 25
Bocklava, Inc. is looking to launch their Software as a Service in an environment that is accredited against a specific control framework (i.e., PCI, ISO). What is the most effective way to ensure the appropriate controls of this environment are properly funded and implemented?
Show answer and explanation
Correct answer: A. Create a business case for the environment to meet all required controls.
Controls required by a framework such as PCI DSS or ISO 27001 cost money and people, and leadership approves that spending through the normal budgeting process. A business case for the new environment lists every control the accreditation requires, estimates the cost of implementing and operating them, and explains the business value, such as the ability to sell the service to customers who demand certification and the risk of failing an audit. Approving the business case commits funding and ownership up front, so the required controls are resourced and built as part of the launch rather than added later.
Why the other options are wrong
- B. A red team assessment identifies weaknesses in controls that already exist, but it does not secure funding or plan the implementation of required controls.
- C. Accreditation requires every control regardless of revenue, so tying control spending to revenue could leave required controls unfunded, especially early on.
- D. Entering requirements in a ticketing system tracks the work but provides no funding or executive commitment to complete it.
Question 26
During a security code review, one of the senior developers complains to the security architect that there have been unauthorized modifications to the code going into the nightly builds. Which of the following methods can ensure only authorized code modifications are part of the nightly builds?
Show answer and explanation
Correct answer: C. Require developer signed commits.
Signed commits attach a cryptographic signature, made with a key held by the developer, to each commit. The repository and the build pipeline can verify the signature against the keys of authorized developers and reject any commit that is unsigned or signed by an unknown key. Because the nightly build accepts only commits that pass this verification, a change inserted by someone without an authorized key, or by an attacker using stolen repository access, is detected and kept out of the build.
Why the other options are wrong
- A. Branch protection restricts how changes reach the main branch, but on its own it does not prove that each commit was authored by an authorized developer.
- B. MFA strengthens login to developer accounts but does not prove who authored each individual commit or stop changes made through other paths.
- D. SAST and DAST look for security flaws in code and running applications and do not check whether a change was authorized.
Question 27
An alert has generated for a malicious file tied to a previously unknown malware. In order to protect the integrity of the investigation, how can the response team automate collection of evidence?
Show answer and explanation
Correct answer: B. Pull the file directly from the system and store in a vault.
Evidence must be collected without changing it, and its handling must be documented. A Splunk SOAR playbook can automatically retrieve the malicious file from the affected host through an endpoint integration and store it in the SOAR vault, which keeps the file with the container for the investigation and identifies it by its hash. Because the original is preserved unchanged and the collection is automated and logged, the team keeps the integrity of the evidence and a record of how it was obtained. Analysts can later work on copies, for example by sending one to a sandbox, without touching the original.
Why the other options are wrong
- A. Detonating the file in a sandbox is an analysis step that executes the sample rather than preserving it as evidence for the investigation.
- C. Sending IOCs to law enforcement is an external reporting decision and does not collect or preserve any evidence for the investigation.
- D. Shutting the system down destroys volatile evidence such as memory contents and running processes, so it harms the integrity of the investigation.
Question 28
Of the following options, which is the best approach to implementing an effective business continuity plan?
Show answer and explanation
Correct answer: D. Define recovery objectives and regularly test the plan.
An effective business continuity plan starts with recovery objectives that come from business impact analysis, such as the recovery time objective (RTO) and recovery point objective (RPO) for each critical process. These objectives drive the recovery strategies and resources the plan needs. Regular testing, through tabletop exercises, simulations and failover tests, then proves the plan works, shows whether the objectives can be met, trains staff in their roles and exposes gaps. Updating the plan after each test and after business or technology changes keeps it accurate, which is what makes it effective when a real disruption occurs.
Why the other options are wrong
- A. Business continuity is driven by critical business processes and their recovery needs, so a plan built only around IT infrastructure misses people, facilities, suppliers and processes.
- B. A one-time plan goes out of date as the business, systems and staff change, and it is never validated by testing.
- C. Offsite backups are a single recovery control that protects data, but they do not define objectives, roles or procedures for keeping the business running.
Question 29
During a recent incident investigation an analyst noted intellectual property being shared externally with unauthorized parties. Upon reporting this through the appropriate channels, the compliance team has engaged an architect to implement controls to alert on and prevent these email communications. Which type of technical control can be implemented to ensure only authorized intellectual property sharing?
Show answer and explanation
Correct answer: D. DLP
Data loss prevention (DLP) inspects the content of data in motion, including email bodies and attachments, against policies that identify sensitive information such as intellectual property through keywords, patterns, document fingerprints or classification labels. When a message would send protected content to an unauthorized recipient, DLP can alert, block, quarantine or require justification, while allowing sharing that the policy authorizes. This directly meets the compliance team's need to both alert on and prevent unauthorized sharing of intellectual property by email.
Why the other options are wrong
- A. SPF lets a domain list the mail servers allowed to send on its behalf and does not inspect message content.
- B. DKIM adds a cryptographic signature that verifies a message came from the signing domain and was not altered, but it does not examine what is being shared.
- C. DMARC builds on SPF and DKIM to tell receivers how to handle mail that fails authentication, and it does not inspect message content for sensitive data.
Question 30
Yokoco has contracted with Helpime to perform a penetration test. The scope of the test is all web facing internet applications. Helpime has completed the test and provided its report to Yokoco. What should be done with the unremediated findings of this report?
Show answer and explanation
Correct answer: B. They should be entered and tracked in the risk register.
Penetration test findings that are not remediated remain open risks to the organization. Entering each one in the risk register records the risk, its likelihood and impact, an owner, the chosen treatment (remediate, mitigate, transfer or accept) and a target date. Leadership can then see the remaining exposure, prioritize it against other risks and make documented decisions, such as formal risk acceptance when a fix is not feasible. Tracking the findings in the register keeps them from being forgotten after the report is delivered and provides accountability until each one is closed.
Why the other options are wrong
- A. A risk register is an internal management tool, and regulators do not maintain risk registers for the organization's findings.
- C. Saving the report for future reference gives no owner, priority or deadline for the open findings, so they are likely to stay unfixed.
- D. Spreading detailed vulnerability findings widely before they are assessed and assigned can expose sensitive information and provides no structured tracking.
That was 30 of 120.
The full Splunk SPLK-5003 pack has all 120 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 60 free as one PDF by email. Get the Half Pack →