Exit demo SPLK-3001 Splunk Enterprise Security Certified Admin PDF format · free preview

Splunk SPLK-3001 - Questions & Answers

Free preview · every answer includes a full explanation

Product page: https://prepkeys.com/splk-3001.html

Question 1
Single choice

Which two fields combine to create the Urgency of a notable event?

A.

Priority and Severity.

B.

Priority and Criticality.

C.

Criticality and Severity.

D.

Precedence and Time.

Question 2
Single choice

What is the main purpose of the Dashboard Requirements Matrix document?

A.

Identifies on which data model(s) each dashboard depends.

B.

Provides instructions for customizing each dashboard for local data models.

C.

Identifies the searches used by the dashboards.

D.

Identifies which data model(s) depend on each dashboard.

Question 3
Single choice

What is the bar across the bottom of any ES window?

A.

The Investigator Workbench.

B.

The Investigation Bar.

C.

The Analyst Bar.

D.

The Compliance Bar.

Question 4
Single choice

Which of these Is a benefit of data normalization?

A.

Reports run faster because normalized data models can be optimized for better performance.

B.

Dashboards take longer to build.

C.

Searches can be built no matter the specific source technology for a normalized data type.

D.

Forwarder-based inputs are more efficient.

Question 5
Single choice

Where is detailed information about identities stored?

A.

The Identity Investigator index.

B.

The Access Anomalies collection.

C.

The User Activity index.

D.

The Identity Lookup CSV file.

Question 6
Single choice

A set of correlation searches are enabled at a new ES installation, and results are being monitored. One of the correlation searches is generating many notable events which, when evaluated, are determined to be false positives.

What is a solution for this issue?

A.

Suppress notable events from that correlation search.

B.

Disable acceleration for the correlation search to reduce storage requirements.

C.

Modify the correlation schedule and sensitivity for your site.

D.

Change the correlation search's default status and severity.

Question 7
Single choice

What feature of Enterprise Security downloads threat intelligence data from a web server?

A.

Threat Service Manager

B.

Threat Download Manager

C.

Threat Intelligence Parser

D.

Therat Intelligence Enforcement

Question 8
Single choice

Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

A.

SplunkWeb (8068), Splunk Management (8089), KV Store (8000)

B.

SplunkWeb (8390), Splunk Management (8323), KV Store (8672)

C.

SplunkWeb (8000), Splunk Management (8089), KV Store (8191)

D.

SplunkWeb (8043), Splunk Management (8088), KV Store (8191)

Question 9
Single choice

Which lookup table does the Default Account Activity Detected correlation search use to flag known default accounts?

A.

Administrative Identities

B.

Local User Intel

C.

Identities

D.

Privileged Accounts

Question 10
Single choice

An administrator is asked to configure an "Nslookup" adaptive response action, so that it appears as a selectable option in the notable event's action menu when an analyst is working in the Incident Review dashboard.

What steps would the administrator take to configure this option?

A.

Configure -> Content Management -> Type: Correlation Search -> Notable -> Nslookup

B.

Configure -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

C.

Configure -> Content Management -> Type: Correlation Search -> Notable -> Next Steps -> Nslookup

D.

Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions -
> Nslookup

Showing 10 of 99 questions · Unlock the full set