10 free sample questions from a bank of 130, with the correct answers and explanations. No signup required — start practising right now.
1Which Enterprise Security framework provides a mechanism for running preconfigured actions within the Splunk platform or integrating with external applications?
Asset and Identity
Notable Event
Threat Intelligence
Adaptive Response
Answer: D
2An analyst would like to visualize threat objects across their environment and chronological risk events for a Risk Object in Incident Review. Where would they find this?
Running the Risk Analysis Adaptive Response action within the Notable Event.
Via a workflow action for the Risk Investigation dashboard.
Via the Risk Analysis dashboard under the Security Intelligence tab in Enterprise Security.
Clicking the risk event count to open the Risk Event Timeline.
Answer: D
3A Risk Rule generates events on Suspicious Cloud Share Activity and regularly contributes to confirmed incidents from Risk Notables. An analyst realizes the raw logs these events are generated from contain information which helps them determine what might be malicious.
What should they ask their engineer for to make their analysis easier?
Create a field extraction for this information.
Add this information to the risk_message.
Create another detection for this information.
Allowlist more events based on this information.
Answer: A
4What device typically sits at a network perimeter to detect command and control and other potentially suspicious traffic?
Host-based firewall
Web proxy
Endpoint Detection and Response
Intrusion Detection System
Answer: D
5Upon investigating a report of a web server becoming unavailable, the security analyst finds that the web server’s access log has the same log entry millions of times:
147.186.119.200 - - [28/Jul/2023:12:04:13 -0300] "GET /login/ HTTP/1.0" 200 3733
What kind of attack is occurring?
Denial of Service Attack
Distributed Denial of Service Attack
Cross-Site Scripting Attack
Database Injection Attack
Answer: A
6According to David Bianco's Pyramid of Pain, which indicator type is least effective when used in continuous monitoring?
Domain names
TTPs
Network/Host artifacts
Hash values
Answer: D
7An analysis of an organization’s security posture determined that a particular asset is at risk and a new process or solution should be implemented to protect it. Typically, who would be in charge of implementing the new process or solution that was selected?
Security Architect
SOC Manager
Security Engineer
Security Analyst
Answer: C
8Which of the following is a correct Splunk search that will return results in the most performant way?
index=foo host=i-478619733 | stats range(_time) as duration by src_ip | bin duration span=5min | stats count by duration, host
| stats range(_time) as duration by src_ip | index=foo host=i-478619733 | bin duration span=5min | stats count by duration, host
index=foo host=i-478619733 | transaction src_ip |stats count by host
9There are many resources for assisting with SPL and configuration questions. Which of the following resources feature community-sourced answers?
Splunk Answers
Splunk Lantern
Splunk Guidebook
Splunk Documentation
Answer: A
10A successful Continuous Monitoring initiative involves the entire organization. When an analyst discovers the need for more context or additional information, perhaps from additional data sources or altered correlation rules, to what role would this request generally escalate?