Free Splunk SPLK-5002 Practice Exam with Questions & Answers | Set: 2

Splunk ' s REST interface provides an action endpoint for disabling a saved search. The appropriate request is an HTTP POST to the saved-search resource ' s /disable action:

curl -k -u admin:pass \

https://localhost:8089/servicesNS/admin/search/saved/searches/TestSearchDevelopment/disable \

-X POST

The key distinction is between operating on the saved-search resource itself and invoking an action against it. DELETE would attempt to remove the saved search entirely rather than merely disabling it. PUT is generally used to update or replace resource state, but Splunk ' s action-style REST endpoints such as /disable are invoked using POST .

This is useful during detection development because an engineer may temporarily disable a scheduled search after validating its behavior, preventing unnecessary execution while preserving the object and its configuration for further development.

The supplied course material covers REST methods, Splunk/SOAR API communication, and automation concepts, but this exact cURL question is not present verbatim in the uploaded question set.

Study Guide topics: Splunk REST API, saved searches, HTTP POST, detection lifecycle, scheduled-search management, API testing.

Status and Owner are the operational fields most directly associated with determining whether a finding has entered active analyst handling. Mean Time to Acknowledge (MTTA) measures the elapsed time between creation of a security finding and the point at which the SOC acknowledges and assumes responsibility for it.

Within an incident-management workflow, assigning an owner indicates analyst responsibility, while a status transition records progression through the handling lifecycle. These changes can therefore be used as workflow evidence when constructing SOC service-level measurements and determining whether findings are being acknowledged within the organization ' s expected response interval.

Urgency and severity describe prioritization characteristics rather than whether an analyst has actually taken ownership. Likewise, user normally describes an entity involved in the underlying security activity and does not represent the analyst responsible for the finding.

From a program-management perspective, MTTA should be distinguished from detection time, investigation duration, containment time, and Mean Time to Resolve/Respond. Each measures a different operational stage. Reliable status and ownership data therefore become important for SOC performance reporting and SLA/SLO auditing.

Question 10 appears on page 3 of the supplied material.

Study Guide topics: SOC metrics, MTTA, finding/notable management, status, ownership, service-level objectives, security-program reporting.

A raw count of firewall blocks measures an output or result , not whether the security capability itself is performing effectively. Under the terminology used by the supplied course material, this makes the measurement a Key Result Indicator rather than a Key Performance Indicator .

For example, a perimeter firewall could block ten million connection attempts because the public-facing address space is being heavily scanned. A second firewall might block only one million. Those numbers alone do not establish that the first firewall is ten times more effective. External scanning volume, Internet exposure, business architecture, and traffic characteristics can change the count independently of firewall performance.

A useful KPI should instead measure performance against a defined operational objective—for example, response latency, policy deployment accuracy, control availability, processing performance, or another measurable objective tied to effectiveness. The total-block count can still provide useful operational context, but it should not automatically be interpreted as evidence that the firewall program is improving.

Option D captures precisely this distinction between activity/result volume and control performance .

Study Guide topics: security metrics, KPIs, result indicators, control effectiveness, SOC reporting, meaningful measurement.

During playbook development and debugging, All Events provides the most consistent test scope because the engineer can repeatedly execute and evaluate the playbook against available event/container data rather than depending exclusively on events created after the playbook was activated.

A scope such as New Events is more appropriate for operational execution when the automation should trigger only as new events arrive. During development, however, restricting execution to newly created objects can make testing inconsistent: an engineer may need to repeatedly create fresh events simply to reproduce the same test case.

The artifact-oriented choices apply when execution is specifically driven by artifact creation or artifact-level behavior. They are not the broad event-level scope requested for consistent playbook debugging.

Using a stable test event is particularly useful when validating branching logic, asset actions, enrichment results, API responses, and downstream automation because the same input can be replayed while the engineer changes individual portions of the playbook.

The supplied study set discusses SOAR playbooks, containers, automation scope, and development workflows, although this exact debugger-scope question is not included verbatim.

Study Guide topics: Splunk SOAR Playbook Debugger, playbook scope, event processing, repeatable testing, automation development.

The most effective way to operationalize a validated threat-hunting result is to create detections based on the documented findings . Threat hunting is exploratory: analysts search historical or current telemetry for behaviors that may not yet have reliable automated coverage. Once a repeatable malicious or suspicious pattern is identified and validated, detection engineering converts that knowledge into an analytic that operates continuously.

This establishes a mature feedback loop:

Threat hunt → validate behavior → document evidence → engineer detection → test → deploy → monitor and tune.

Reports and communication remain valuable, particularly for management, architecture, and lessons learned, but they do not provide continuous identification of recurrence. A detection allows the SOC to identify the behavior automatically during routine operations and present relevant results to analysts.

The detection should preserve the context learned during the hunt, including useful fields, appropriate time windows, entity information, exclusions, and potentially ATT & CK annotations or risk information. Engineers should also assess whether the hunting evidence supports a sufficiently reliable analytic to avoid excessive false positives.

Study Guide topics: threat hunting, detection operationalization, detection lifecycle, hunt-to-detection workflow, continuous security monitoring.

Correlation search throttling is specifically intended to suppress repeated results that represent the same or substantially equivalent detection condition within a defined period. It is therefore the appropriate setting when a correlation search generates multiple findings for what analysts consider one potential incident.

Throttling is generally based on one or more result fields and a suppression period. For example, if repeated executions identify the same user and dest, the search can suppress additional findings matching that combination during the configured interval. This reduces redundant analyst workload while allowing materially different entities or events to generate new findings.

The engineering requirement is to select throttling fields carefully. Overly broad suppression can conceal genuinely distinct security events, while overly narrow suppression may fail to reduce duplicate findings. The suppression period likewise should reflect the behavior being detected and the expected recurrence pattern.

Correlation search priority affects prioritization rather than duplication. An adaptive risk modifier adds or modifies risk-related information but does not directly solve repeated notable generation. Adaptive response actions control downstream outcomes rather than the duplicate-suppression behavior requested.

Study Guide topics: correlation-search throttling, duplicate findings, notable suppression, detection tuning, analyst workload, false-positive reduction.

The correct combination is the Risk Framework and the Assets & Identities Framework .

The Risk Framework is responsible for associating security observations with risk objects , such as users, systems, IP addresses, or other entities. In the exhibit, multiple threat objects are linked to various risk objects, and accumulated activity contributes to the displayed risk score and event count. This allows Enterprise Security to correlate multiple security observations around an entity rather than treating each event independently.

The Assets & Identities Framework provides the enrichment necessary to recognize that different usernames, email addresses, aliases, devices, or accounts can represent the same underlying identity . In the screenshot, several identity aliases are shown as belonging to Fyodor. This framework supplies the contextual relationship that lets Enterprise Security consolidate those identifiers around one owner.

Threat Intelligence can provide malicious indicators, but it does not perform the identity-resolution function described. Incident Review is primarily an analyst workflow interface rather than the framework creating these programmatic entity relationships.

The same Risk Events/Threat Topology scenario is included in the supplied Cybersecurity Defense Engineer material.

Study Guide topics: Risk Framework, Assets & Identities Framework, risk objects, identity aliases, entity enrichment, Threat Topology, Risk-Based Alerting.

Applying suppression rules for false positives improves the operational effectiveness of Enterprise Security notable events because it reduces repetitive or known-benign findings that would otherwise consume analyst attention. Effective detection engineering is not measured simply by how many notables are generated; it is measured by whether the resulting findings are sufficiently relevant, actionable, and prioritized for investigation.

Suppression can prevent repeated findings that match defined conditions during a configured period. For example, a known administrative process, sanctioned vulnerability scanner, or repeatedly detected condition may be excluded or suppressed when its behavior has already been validated. The supplied material reinforces this principle through its discussion of correlation-search throttling , where repeated findings for the same potential incident are reduced rather than continually presented to analysts.

Limiting a search to one index can unnecessarily exclude relevant telemetry. Using only raw logs sacrifices the benefits of CIM, accelerated data models, and normalized fields. Disabling scheduled searches would prevent recurring correlation searches from identifying new suspicious activity.

Study Guide topics: correlation-search tuning, throttling/suppression, false-positive reduction, notable-event quality, analyst workload, detection effectiveness.

Mission Control determines the applicable response workflow through the relationship between response templates and incident types . Therefore, response templates are assigned to specific incident types , making option C the appropriate mechanism.

A response template provides structured guidance for handling a defined class of incident. Associating that template with an incident type creates deterministic workflow behavior: findings categorized into that incident type can receive the corresponding response structure. This approach is preferable to ad hoc assignment because it standardizes how analysts respond to recurring security scenarios.

The detection itself can provide useful classification and contextual metadata, but simply creating a detection in Enterprise Security does not inherently define the complete Mission Control response-template mapping. Likewise, the selection is not based on an unspecified AI process. SOAR can participate in downstream orchestration and automation, but Mission Control response-template configuration is not limited exclusively to SOAR.

Architecturally, this supports separation of concerns: detections identify suspicious behavior, incident categorization determines the operational response context, and response templates establish the standardized handling procedure.

Study Guide topics: Mission Control, response templates, incident types, finding management, workflow standardization, Enterprise Security integration.

Splunk macros make SPL shorter and reusable by encapsulating frequently used search fragments and allowing them to be inserted into other searches. A macro can contain filters, field calculations, constraints, or larger portions of SPL that would otherwise need to be duplicated across multiple detections, reports, and dashboards.

Macros are typically invoked using backticks, conceptually:

search index=security | security_filter``

The macro is resolved at search execution time into the SPL definition associated with it. Parameterized macros can also accept arguments, allowing common search logic to be reused with different values.

This is particularly important for detection engineering because centralized reusable logic reduces duplication. If ten correlation searches rely on the same constraint, a macro allows the engineer to maintain that logic centrally rather than changing all ten searches independently.

Although macros are themselves Splunk knowledge objects, Knowledge objects is too broad for the question. Lookups add external or maintained contextual data to events, while commands such as stats, eval, or tstats perform specific SPL operations rather than serving as reusable search substitutions.

Study Guide topics: SPL macros, reusable searches, search maintainability, knowledge objects, detection engineering efficiency.