View Full Splunk SPLK-5001 Exam Dumps and Practice Test Dumps.

Question 261. What is the goal of Initial Access?

1. Destroy stored data
2. Gain entry to the environment
3. Collect credentials
4. Maintain persistence

Correct Answer: 2. Gain entry to the environment

Explanation:

Initial Access describes adversary activity intended to gain entry into a target environment. Common examples include phishing, exploiting an internet-facing application, abusing external remote services, trusted relationships, supply-chain compromise, and valid accounts. Once initial access succeeds, the adversary can attempt execution, persistence, credential theft, or other follow-on activity. Security analysts should correlate email, authentication, network, endpoint, and application evidence when investigating possible initial access. MITRE ATT&CK defines this tactic as the adversary attempting to get into the network, and Splunk can map detections to ATT&CK tactics for added investigation context.

Question 262. What is the goal of Persistence?

1. Find network hosts
2. Steal files
3. Disable logging
4. Maintain a foothold

Correct Answer: 4. Maintain a foothold

Explanation:

Persistence refers to techniques attackers use to maintain access after the original entry method is interrupted or removed. Examples can include manipulating accounts, creating scheduled tasks, modifying startup mechanisms, or abusing valid credentials. Persistence is important because attackers often need continued access across logouts, password changes, reboots, or temporary connection loss. Analysts can hunt for newly created services, unexpected account changes, suspicious scheduled activity, and other configuration changes. MITRE ATT&CK defines Persistence as the adversary trying to maintain a foothold in the target environment.

Question 263. What is Privilege Escalation?

1. Gaining higher permissions
2. Compressing stolen data
3. Mapping the network
4. Sending phishing mail

Correct Answer: 1. Gaining higher permissions

Explanation:

Privilege Escalation occurs when an attacker attempts to obtain permissions beyond those currently available. For example, a compromised standard user might be used to gain administrator, root, or another privileged role. Elevated access can allow attackers to disable controls, access protected information, manipulate other accounts, or move deeper into the environment. Analysts should examine privilege changes, unusual administrative activity, process execution, and access to sensitive resources. MITRE ATT&CK defines the Privilege Escalation tactic as the adversary attempting to gain higher-level permissions.

Question 264. What is the goal of Stealth?

1. Gain initial entry
2. Collect documents
3. Hide malicious activity
4. Restore services

Correct Answer: 3. Hide malicious activity

Explanation:

In the current Enterprise ATT&CK model, Stealth covers adversary behavior intended to hide or conceal malicious actions so they appear more like legitimate activity. Attackers may use trusted tools, disguise processes, alter artifacts, or otherwise reduce the chance of being noticed. For defenders, this makes behavioral analysis important because obvious malicious indicators may be absent. Splunk searches that compare activity with baselines, identify rare behaviors, and correlate multiple data sources can help reveal suspicious actions even when attackers attempt to blend into normal operations.

Question 265. What is Defense Impairment intended to do?

1. Enumerate accounts
2. Exfiltrate files
3. Create persistence
4. Weaken security mechanisms

Correct Answer: 4. Weaken security mechanisms

Explanation:

Defense Impairment describes adversary actions intended to damage or interfere with security mechanisms, monitoring pipelines, or defensive tooling. Examples can include disabling security software, modifying logging, interfering with sensors, or weakening controls so defenders cannot reliably observe the attack. This differs from simply trying to blend in; the attacker is actively reducing defensive capability. Analysts should investigate unexpected service stops, policy modifications, telemetry gaps, or changes to security tooling. Current MITRE ATT&CK lists Defense Impairment as a distinct Enterprise tactic.

Question 266. What is Credential Access focused on?

1. Identifying software
2. Stealing account credentials
3. Deleting backups
4. Compressing files

Correct Answer: 2. Stealing account credentials

Explanation:

Credential Access covers attacker techniques used to obtain usernames, passwords, password hashes, tokens, authentication material, or other secrets that enable access. Examples include brute forcing credentials, dumping operating-system credentials, or stealing authentication data from applications. Compromised credentials can then support persistence, privilege escalation, lateral movement, or access to cloud services. Authentication and endpoint telemetry are therefore important sources when investigating credential theft. MITRE ATT&CK defines Credential Access as the adversary trying to steal account names and passwords.

Question 267. What is Discovery used for?

1. Delete logs
2. Deliver malware
3. Learn about the environment
4. Restore systems

Correct Answer: 3. Learn about the environment

Explanation:

Discovery consists of techniques used by attackers to understand the compromised environment. They may enumerate accounts, systems, network connections, security software, services, groups, applications, or other resources. This information helps the adversary decide where to move next and which targets are valuable. Analysts can hunt for unusual enumeration commands, rapid queries across many systems, or account activity inconsistent with normal job functions. MITRE describes Discovery as the adversary attempting to figure out the victim environment.

Question 268. What is Lateral Movement?

1. Moving between systems
2. Collecting documents
3. Removing malware
4. Creating phishing messages

Correct Answer: 1. Moving between systems

Explanation:

Lateral Movement describes attacker activity used to move from one system, service, or account to another inside the target environment. An adversary may use remote services, stolen credentials, shared resources, or exploitation techniques to expand access after the initial compromise. Analysts should correlate authentication logs, remote-access events, endpoint process data, and network connections to identify unusual movement patterns. MITRE ATT&CK describes Lateral Movement as the adversary attempting to move through the environment. Detecting it early can limit how far an intrusion spreads.

Question 269. What is the goal of Collection?

1. Gain administrator rights
2. Hide processes
3. Create accounts
4. Gather data of interest

Correct Answer: 4. Gather data of interest

Explanation:

Collection includes adversary techniques for gathering information that supports the attacker’s objectives. Examples may include collecting local files, capturing screenshots, gathering email, querying information repositories, or staging data before exfiltration. Collection usually occurs after an attacker has gained enough access to reach valuable information. Analysts can look for unusual file access, bulk data reads, unexpected archive creation, or processes accessing sensitive repositories. MITRE ATT&CK defines Collection as gathering data of interest to the adversary’s goal.

Question 270. What is Exfiltration?

1. Removing data from the environment
2. Increasing permissions
3. Enumerating hosts
4. Installing persistence

Correct Answer: 1. Removing data from the environment

Explanation:

Exfiltration covers methods attackers use to transfer stolen information outside the victim environment. Data may leave through web services, cloud storage, command-and-control channels, removable media, or other network protocols. Analysts should investigate unusual outbound volumes, connections to uncommon destinations, new cloud-storage usage, and data transfers that differ from established baselines. MITRE ATT&CK defines Exfiltration as the adversary attempting to steal data. Splunk searches can correlate network, proxy, endpoint, and cloud telemetry to identify suspicious outbound transfers.

Question 271. What is the Impact tactic aimed at?

1. Collecting passwords
2. Disrupting or destroying systems or data
3. Enumerating applications
4. Maintaining access

Correct Answer: 2. Disrupting or destroying systems or data

Explanation:

Impact includes attacker actions intended to manipulate, interrupt, degrade, or destroy systems and data. Examples can include ransomware encryption, destructive file operations, service interruption, account lockouts, or denial-of-service activity. Impact techniques often represent the visible outcome of an intrusion, although earlier attack stages may have occurred long before the disruption becomes obvious. Analysts should correlate impact evidence with earlier authentication, endpoint, network, and risk activity to reconstruct the complete attack timeline. MITRE ATT&CK describes Impact as manipulating, interrupting, or destroying systems and data.

Question 272. What does Brute Force attempt?

1. Compress data
2. Disable antivirus
3. Guess or derive credentials
4. Enumerate network routes

Correct Answer: 3. Guess or derive credentials

Explanation:

Brute Force refers to attempts to obtain valid account access when credentials are unknown or partially known. Attackers may repeatedly guess passwords, crack password hashes offline, spray a small number of passwords across many accounts, or reuse previously stolen username-password combinations. Analysts can look for repeated failures, many accounts targeted by one source, or successful authentication following unusual failure patterns. MITRE ATT&CK classifies Brute Force as a Credential Access technique and includes password guessing, password cracking, password spraying, and credential stuffing as sub-techniques.

Question 273. What characterizes password spraying?

1. Few passwords across many accounts
2. Many passwords against one account only
3. Deleting credentials
4. Creating new administrators

Correct Answer: 1. Few passwords across many accounts

Explanation:

Password spraying attempts one or a small set of common passwords against many different accounts rather than repeatedly attacking a single account. This approach can help an attacker avoid traditional lockout controls that trigger after many failed attempts against one username. Analysts should look for authentication failures involving many users but relatively few repeated password attempts from the same source or infrastructure. Password spraying is one of the sub-techniques categorized under MITRE ATT&CK Brute Force and is commonly investigated using authentication data.

Question 274. What is credential stuffing?

1. Creating random usernames
2. Dumping memory
3. Resetting passwords
4. Reusing stolen username-password pairs

Correct Answer: 4. Reusing stolen username-password pairs

Explanation:

Credential stuffing uses previously compromised username and password combinations to attempt access to other systems or services. It works because users sometimes reuse credentials across multiple sites. Unlike ordinary password guessing, the attacker already possesses candidate credential pairs from another breach or collection source. Analysts may observe large numbers of login attempts using many different accounts, often from automated infrastructure. MITRE ATT&CK identifies Credential Stuffing as a Brute Force sub-technique under Credential Access.

Question 275. Why are Valid Accounts attractive to attackers?

1. They always bypass MFA
2. They can provide legitimate-looking access
3. They delete telemetry
4. They automatically gain root

Correct Answer: 2. They can provide legitimate-looking access

Explanation:

Valid Accounts can give an attacker access through normal authentication mechanisms, which may make malicious activity appear more legitimate than malware-based intrusion. Compromised credentials can be used for initial access, persistence, privilege escalation, or stealth-related activity depending on the account and environment. Attackers may access VPNs, cloud services, remote desktops, network devices, or other resources using legitimate credentials. Analysts should therefore evaluate unusual login times, locations, devices, privileges, and subsequent activity rather than assuming a successful login is trustworthy.

Question 276. What does Account Manipulation do?

1. Deletes all users
2. Collects network packets
3. Modifies accounts to preserve or increase access
4. Compresses files

Correct Answer: 3. Modifies accounts to preserve or increase access

Explanation:

Account Manipulation involves changing account credentials, permissions, roles, authentication methods, or related settings to preserve or increase attacker access. Examples include adding cloud credentials, granting additional roles, or modifying permission groups. These changes can support persistence or privilege escalation and may survive changes to the attacker’s original access method. Analysts should monitor sensitive account modifications, role assignments, authentication-factor changes, and administrative operations. MITRE ATT&CK describes Account Manipulation as actions that preserve or modify adversary access to compromised accounts.

Question 277. Why archive collected data?

1. Increase account privileges
2. Prepare data for transfer
3. Discover hosts
4. Disable monitoring

Correct Answer: 2. Prepare data for transfer

Explanation:

Attackers may compress or encrypt collected information before exfiltration. Archiving can reduce the amount of data that must be transferred, combine many files into one package, and sometimes make the content less obvious during transmission. Analysts can hunt for unusual archive creation, especially when sensitive files are accessed shortly beforehand or large outbound transfers occur soon afterward. MITRE ATT&CK describes Archive Collected Data as a technique in which collected information is compressed or encrypted before exfiltration.

Question 278. What can Exfiltration Over Web Service abuse?

1. Legitimate external web services
2. Only removable drives
3. Local administrator groups
4. Only DNS caches

Correct Answer: 1. Legitimate external web services

Explanation:

Exfiltration Over Web Service involves transferring stolen data through legitimate external services rather than relying only on a dedicated malicious channel. Examples can include cloud storage, code repositories, text-sharing sites, or webhook endpoints. These services may already be permitted by firewalls and commonly use encrypted HTTPS, allowing malicious transfers to blend with expected network traffic. Analysts should look for unusual upload volume, new service usage, unexpected processes connecting to cloud platforms, and transfers from sensitive systems. MITRE ATT&CK identifies this behavior as technique T1567.

Question 279. What can Remote Services enable?

1. File compression only
2. Password hashing
3. Threat-feed ingestion
4. Movement to other systems

Correct Answer: 4. Movement to other systems

Explanation:

Remote services can allow users to access and administer other systems across the network. Attackers with valid credentials or appropriate access may abuse these services to move laterally within a compromised environment. Examples can include remote desktop, remote shells, administrative protocols, or other supported remote-management services. Analysts should investigate unusual remote logins, new source-to-destination relationships, privileged account use, and connections occurring outside normal administrative patterns. MITRE ATT&CK includes Remote Services among techniques associated with movement through an environment.

Question 280. Why map detections to ATT&CK techniques?

1. Reduce index size
2. Change usernames
3. Understand coverage and adversary behavior
4. Disable findings

Correct Answer: 3. Understand coverage and adversary behavior

Explanation:

Mapping detections to MITRE ATT&CK gives analysts structured context about what adversary behavior a detection is intended to identify. Splunk Enterprise Security Detection Studio can display detection coverage and gaps across ATT&CK tactics and techniques. This helps teams identify missing security content, understand which behaviors are represented by findings, and improve detection engineering. Splunk also enriches risk activity with ATT&CK information so analysts can view several behaviors associated with the same entity in a broader attack context rather than treating every finding independently.