An organization is using Risk-Based Alerting (RBA). During the past few days, a user account generated multiple risk observations. Splunk refers to this account as what type of entity?

Question

Options

• ARisk Factor
• BRisk Index
• CRisk Analysis
• DRisk Object

• A
  7% (5)
• B
  89% (62)
• C
  3% (2)
• D
  1% (1)

Explanation

Heads-up: The marked correct answer (B) appears to be incorrect. Based on Splunk's RBA documentation, the actual correct answer is D. Risk Object.

In Splunk's Risk-Based Alerting framework, a Risk Object is any entity - such as a user account, host, or IP address - that accumulates risk scores from multiple risk observations over time. When a user account triggers several risk events, Splunk identifies that account as a Risk Object and aggregates its score for alerting purposes.

Why the distractors are wrong:

• A. Risk Factor - A risk factor is a multiplier or modifier applied to risk scores, not the entity itself.
• B. Risk Index - The risk index (risk) is the Splunk data store where risk events are written; it's a location, not an entity type.
• C. Risk Analysis - This refers to the correlation search or process that evaluates accumulated risk; it's an action, not an entity label.

Memory tip: Think of a Risk Object as the subject being watched - it's the "who" or "what" collecting risk points. The risk index is just the bucket holding the data. If the exam asks about an entity accumulating observations, the answer is always Risk Object.

Double-check your source material - if this is from a practice exam, the answer key may contain a typo.

No community discussion yet for this question.