SPLK-5001 Practice Test

SPLK-5001 Practice Test practice questions, page 4 of 6, with answer review and explanations.

Question 16

Which of the following is a correct Splunk search that will return results in the most performant way?

  1. index=foo host=i-478619733 | stats range(_time) as duration by src_ip | bin duration span=5min | stats count by duration, host
  2. | stats range(_time) as duration by src_ip | index=foo host=i-478619733 | bin duration span=5min | stats count by duration, host
  3. index=foo host=i-478619733 | transaction src_ip |stats count by host
  4. index=foo | transaction src_ip |stats count by host | search host=i-478619733

Question 17

There are many resources for assisting with SPL and configuration questions. Which of the following resources feature community-sourced answers?

  1. Splunk Answers
  2. Splunk Lantern
  3. Splunk Guidebook
  4. Splunk Documentation

Question 18

A successful Continuous Monitoring initiative involves the entire organization. When an analyst discovers the need for more context or additional information, perhaps from additional data sources or altered correlation rules, to what role would this request generally escalate?

  1. SOC Manager
  2. Security Analyst
  3. Security Engineer
  4. Security Architect

Question 19

Splunk Enterprise Security has numerous frameworks to create correlations, integrate threat intelligence, and provide a workflow for investigations. Which framework raises the threat profile of individuals or assets to allow identification of people or devices that perform an unusual amount of suspicious activities?

  1. Threat Intelligence Framework
  2. Risk Framework
  3. Notable Event Framework
  4. Asset and Identity Framework

Question 20

While the top command is utilized to find the most common values contained within a field, a Cyber Defense Analyst hunts for anomalies. Which of the following Splunk commands returns the least common values?

  1. least
  2. uncommon
  3. rare
  4. base