SPLK-5001 Sample Questions & Answers

Timestamp extraction is a parsing-time activity defined in props.conf. An administrator would create a stanza for the specific sourcetype (e.g., [my_custom_app]) and use attributes like TIME_PREFIX, TIME_FORMAT, and MAX_TIMESTAMP_LOOKAHEAD to tell Splunk how to correctly identify and parse the timestamp from the raw event data. This configuration needs to be on the parsing tier, which is typically the indexers or a heavy forwarder.

The key differentiator is the number of sources. A Denial of Service (DoS) attack attempts to make a service unavailable by overwhelming it with traffic from a single machine. A Distributed Denial of Service (DDoS) attack uses a network of compromised machines (a botnet) to launch a coordinated attack from many different sources simultaneously, making it much harder to block.

The Asset and Identity Framework is designed specifically for this purpose. It correlates various identifiers (like IP addresses, hostnames, MAC addresses, and user IDs) found in logs with the authoritative information stored in the asset and identity lookups. This allows ES to attribute activity consistently to the correct asset or user, which is fundamental for effective correlation and risk analysis.

Splunk Security Essentials acts as a 'getting started' guide. It allows a team to see what security detections are possible, which data sources are required for those detections, and provides example SPL. This helps teams prioritize data onboarding efforts and quickly demonstrate the value of Splunk for security before or alongside a full ES deployment.

Social engineering exploits human psychology rather than technical vulnerabilities. Attackers use techniques like phishing, pretexting, and baiting because it is often easier to trick a person into giving up their credentials, running a malicious file, or granting access than it is to break through multiple layers of technical security controls.

A supply chain attack compromises an organization by targeting its trusted third-party partners or providers. For example, an attacker might inject malicious code into a software update from a trusted vendor. When the organization installs the update, it unknowingly introduces the malware into its own environment. This allows attackers to bypass the target's direct security controls.

An Advanced Persistent Threat (APT) is the correct term for a sophisticated, well-funded, and patient threat actor (often a group) that targets specific entities over a long period. Their goals are typically espionage or strategic disruption, and they use advanced techniques to remain undetected.

The primary purpose of the Common Information Model (CIM) is data normalization. It provides a standardized set of field names and tags for different types of security data. When data from various vendors is mapped to the CIM, a single correlation search can be written to query the standardized field (e.g., src) and it will automatically work across all compliant data sources. This enables correlation and makes pre-built content portable.

The Splunk Common Information Model (CIM) provides a standardized set of field names for different data types. Splunk Enterprise Security content, including correlation searches and dashboards, relies on these CIM-compliant field names (like src_ip, dest_port). To ensure the new data source works with this pre-built content, its fields must be normalized (aliased or renamed) to match the CIM.

A Command and Control (C2 or C&C) channel is a communication path used by an attacker to maintain control over a compromised system. This channel allows the attacker to send commands, upload additional malware, and exfiltrate data. Using legitimate tools to create this channel is a common technique to evade detection.