SPLK-5001 · Question #26
The United States Department of Defense (DoD) requires all government contractors to provide adequate security safeguards referenced in National Institute of Standards and Technology (NIST) 800-171…
The correct answer is D. Framework mapping. Framework Mapping in Splunk Enterprise Security is the feature that tags correlation searches with specific compliance framework controls - in this case, linking detections directly to NIST 800-171 requirements - giving analysts immediate regulatory context when triaging alerts…
Question
The United States Department of Defense (DoD) requires all government contractors to provide adequate security safeguards referenced in National Institute of Standards and Technology (NIST) 800-171. All DoD contractors must continually reassess, monitor, and track compliance to be able to do business with the US government. Which feature of Splunk Enterprise Security provides an analyst context for the correlation search mapping to the specific NIST guidelines?
Options
- AComments
- BMoles
- CAnnotations
- DFramework mapping
How the community answered
(44 responses)- A5% (2)
- B7% (3)
- C2% (1)
- D86% (38)
Explanation
Framework Mapping in Splunk Enterprise Security is the feature that tags correlation searches with specific compliance framework controls - in this case, linking detections directly to NIST 800-171 requirements - giving analysts immediate regulatory context when triaging alerts without having to look up which control applies.
Why the distractors are wrong:
- A (Comments): Comments allow analysts to add free-text notes to notable events; they don't structurally map searches to compliance frameworks.
- B (Moles): This is a fabricated term - no such feature exists in Splunk ES; classic distractor designed to catch guessers.
- C (Annotations): Annotations in Splunk ES are metadata labels (e.g., MITRE ATT&CK technique IDs) applied to events, but the specific named feature for connecting correlation searches to compliance frameworks is Framework Mapping - Annotations is the near-miss trap answer here.
Memory tip: The word "mapping" appears in both the question ("mapping to the specific NIST guidelines") and the answer (Framework Mapping) - the question essentially telegraphs the answer. On exam day, when you see "compliance framework" + "correlation search" + "context," the answer will always be Framework Mapping.
Topics
Community Discussion
No community discussion yet for this question.