Splunk Updated SPLK-5002 Exam Questions and Answers by irha

An Endpoint Detection and Response (EDR) product operates primarily on endpoint processes, files, devices, and endpoint-derived indicators. Accordingly, the actions most naturally associated with an EDR integration are block hash, block process, quarantine device, and get indicator .

Blocking a file hash prevents a known malicious executable from running or being accepted by the endpoint control plane. Blocking or terminating a process directly addresses active execution. Quarantining or isolating a device provides containment by restricting network communication while allowing security personnel to continue investigation. Retrieving indicators allows the SOAR workflow to enrich subsequent decisions using endpoint telemetry.

The other choices combine actions normally owned by different security controls. Removing an email generally belongs to an email-security platform; detonating a URL is normally performed by a sandbox or analysis service; blocking domains or subdomains typically involves DNS, proxy, or network-security technology; and resetting a password is usually performed through an identity provider or directory service.

A well-designed Splunk SOAR playbook therefore maps actions to the capabilities of the integrated asset rather than assuming every security control can perform every response operation.

Study Guide topics: Splunk SOAR assets, EDR integrations, endpoint containment, playbook actions, orchestration, response-tool capability mapping.

The Threat Intelligence Framework provides the Enterprise Security capability for managing known indicators of compromise and correlating those indicators with observed event data. It is therefore the framework used when engineers want to compare malicious IOCs against telemetry to identify suspicious activity.

Indicators can represent objects such as IP addresses, domains, URLs, file hashes, certificates, or other observable threat artifacts. Enterprise Security processes and normalizes threat intelligence so that matching logic can compare those intelligence objects against compatible fields contained in security events.

For example, a known malicious domain may be compared against DNS or web telemetry, while a malicious IP address may be compared against network connections. A match can subsequently contribute to a finding, risk event, enrichment workflow, or additional investigation depending on the implemented detection strategy.

The Assets & Identities functionality concerns organizational context around entities rather than IOC matching. Incident management handles investigation and response workflows. OSINT describes a category of intelligence collection but is not the Enterprise Security framework requested.

Study Guide topics: Threat Intelligence Framework; IOCs; threat matching; threat-intelligence normalization; event correlation; indicator-based detection.

A Risk Factor is best characterized as a multiplier of risk based on contextual characteristics of a specific user or asset . It allows Enterprise Security to adjust the significance of an otherwise identical security observation depending on the entity involved.

Suppose a detection normally produces a risk score representing suspicious authentication behavior. If the affected host is an ordinary workstation, the base score may appropriately represent its significance. If the same activity affects a domain controller, highly sensitive database, privileged administrator, or other critical entity, a Risk Factor can increase the resulting risk so that the situation receives greater analytical priority.

This enables organizations to incorporate business context into Risk-Based Alerting without duplicating detection logic for every asset category. The detection identifies the behavior; the Risk Factor modifies its importance according to contextual conditions.

A Risk Factor is not itself simply another risk event, nor is its purpose to accelerate a data model. It is also unrelated to a SOAR action generated from detection annotations. Its role is contextual adjustment of risk , supporting more meaningful aggregation and escalation.

Study Guide topics: Risk-Based Alerting; Risk Factors; risk multiplication; asset criticality; identity context; risk prioritization.

A Sysmon Process Create event is identified by Event ID 1 , making EventCode=1 the correct selection. This event type is among the most important endpoint telemetry sources for detection engineering because it records process execution and provides fields useful for reconstructing process relationships and identifying suspicious command execution.

Typical Process Create telemetry can contain attributes such as the process image, command line, process identifier, parent process, parent command line, user context, hashes, integrity level, and process GUID. These fields support detections for suspicious scripting interpreters, unusual parent-child relationships, LOLBins, encoded commands, malware execution, and other endpoint behaviors.

The remaining event IDs represent different Sysmon activities. Event ID 2 concerns changes to file creation time, while Event ID 3 represents network connections when that telemetry is enabled. Event ID 4 records changes in the Sysmon service state. None of those describes the process-creation record shown in the question.

Correct event-type interpretation is fundamental to building accurate SPL because filtering on the wrong EventCode can completely change the semantic meaning of a detection.

Study Guide topics: Sysmon telemetry, Event ID 1, process creation, Windows endpoint data, process analytics, event normalization.