Black Friday Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70percent

Splunk SPLK-3001 Splunk Enterprise Security Certified Admin Exam Exam Practice Test

Demo: 29 questions
Total 99 questions

Splunk Enterprise Security Certified Admin Exam Questions and Answers

Question 1

To observe what network services are in use in a network’s activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?

Options:

A.

Intrusion Center

B.

Protocol Analysis

C.

User Intelligence

D.

Threat Intelligence

Question 2

What does the Security Posture dashboard display?

Options:

A.

Active investigations and their status.

B.

A high-level overview of notable events.

C.

Current threats being tracked by the SOC.

D.

A display of the status of security tools.

Question 3

What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?

Options:

A.

ess_user

B.

ess_admin

C.

ess_analyst

D.

ess_reviewer

Question 4

What tools does the Risk Analysis dashboard provide?

Options:

A.

High risk threats.

B.

Notable event domains displayed by risk score.

C.

A display of the highest risk assets and identities.

D.

Key indicators showing the highest probability correlation searches in the environment.

Question 5

What does the risk framework add to an object (user, server or other type) to indicate increased risk?

Options:

A.

An urgency.

B.

A risk profile.

C.

An aggregation.

D.

A numeric score.

Question 6

How is it possible to navigate to the ES graphical Navigation Bar editor?

Options:

A.

Configure -> Navigation Menu

B.

Configure -> General -> Navigation

C.

Settings -> User Interface -> Navigation -> Click on “Enterprise Security”

D.

Settings -> User Interface -> Navigation Menus -> Click on “default” next to SplunkEnterpriseSecuritySuite

Question 7

Which of the following is a Web Intelligence dashboard?

Options:

A.

Network Center

B.

Endpoint Center

C.

HTTP Category Analysis

D.

stream: http Protocol dashboard

Question 8

When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

Options:

A.

$fieldname$

B.

“fieldname”

C.

%fieldname%

D.

_fieldname_

Question 9

Analysts have requested the ability to capture and analyze network traffic data. The administrator has researched the documentation and, based on this research, has decided to integrate the Splunk App for Stream with ES.

Which dashboards will now be supported so analysts can view and analyze network Stream data?

Options:

A.

Endpoint dashboards.

B.

User Intelligence dashboards.

C.

Protocol Intelligence dashboards.

D.

Web Intelligence dashboards.

Question 10

At what point in the ES installation process should Splunk_TA_ForIndexes.spl be deployed to the indexers?

Options:

A.

When adding apps to the deployment server.

B.

Splunk_TA_ForIndexers.spl is installed first.

C.

After installing ES on the search head(s) and running the distributed configuration management tool.

D.

Splunk_TA_ForIndexers.spl is only installed on indexer cluster sites using the cluster master and the splunk apply cluster-bundle command.

Question 11

A newly built custom dashboard needs to be available to a team of security analysts In ES. How is It possible to Integrate the new dashboard?

Options:

A.

Add links on the ES home page to the new dashboard.

B.

Create a new role Inherited from es_analyst, make the dashboard permissions read-only, and make this dashboard the default view for the new role.

C.

Set the dashboard permissions to allow access by es_analysts and use the navigation editor to add it to the menu.

D.

Add the dashboard to a custom add-in app and install it to ES using the Content Manager.

Question 12

What is the default schedule for accelerating ES Datamodels?

Options:

A.

1 minute

B.

5 minutes

C.

15 minutes

D.

1 hour

Question 13

Which of the following is a key feature of a glass table?

Options:

A.

Rigidity.

B.

Customization.

C.

Interactive investigations.

D.

Strong data for later retrieval.

Question 14

Which of the following would allow an add-on to be automatically imported into Splunk Enterprise Security?

Options:

A.

A prefix of CIM_

B.

A suffix of .spl

C.

A prefix of TECH_

D.

A prefix of Splunk_TA_

Question 15

What feature of Enterprise Security downloads threat intelligence data from a web server?

Options:

A.

Threat Service Manager

B.

Threat Download Manager

C.

Threat Intelligence Parser

D.

Therat Intelligence Enforcement

Question 16

An administrator is provisioning one search head prior to installing ES. What are the reference minimum requirements for OS, CPU, and RAM for that machine?

Options:

A.

OS: 32 bit, RAM: 16 MB, CPU: 12 cores

B.

OS: 64 bit, RAM: 32 MB, CPU: 12 cores

C.

OS: 64 bit, RAM: 12 MB, CPU: 16 cores

D.

OS: 64 bit, RAM: 32 MB, CPU: 16 cores

Question 17

Which of the following are examples of sources for events in the endpoint security domain dashboards?

Options:

A.

REST API invocations.

B.

Investigation final results status.

C.

Workstations, notebooks, and point-of-sale systems.

D.

Lifecycle auditing of incidents, from assignment to resolution.

Question 18

Accelerated data requires approximately how many times the daily data volume of additional storage space per year?

Options:

A.

3.4

B.

5.7

C.

1.0

D.

2.5

Question 19

ES needs to be installed on a search head with which of the following options?

Options:

A.

No other apps.

B.

Any other apps installed.

C.

All apps removed except for TA-*.

D.

Only default built-in and CIM-compliant apps.

Question 20

Where is detailed information about identities stored?

Options:

A.

The Identity Investigator index.

B.

The Access Anomalies collection.

C.

The User Activity index.

D.

The Identity Lookup CSV file.

Question 21

A set of correlation searches are enabled at a new ES installation, and results are being monitored. One of the correlation searches is generating many notable events which, when evaluated, are determined to be false positives.

What is a solution for this issue?

Options:

A.

Suppress notable events from that correlation search.

B.

Disable acceleration for the correlation search to reduce storage requirements.

C.

Modify the correlation schedule and sensitivity for your site.

D.

Change the correlation search's default status and severity.

Question 22

What do threat gen searches produce?

Options:

A.

Threat Intel in KV Store collections.

B.

Threat correlation searches.

C.

Threat notables in the notable index.

D.

Events in the threat activity index.

Question 23

ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

Options:

A.

$SPLUNK_HOME/etc/master-apps/

B.

$SPLUNK_HOME/etc/system/local/

C.

$SPLUNK_HOME/etc/shcluster/apps

D.

$SPLUNK_HOME/var/run/searchpeers/

Question 24

An administrator wants to ensure that none of the ES indexed data could be compromised through tampering. What feature would satisfy this requirement?

Options:

A.

Index consistency.

B.

Data integrity control.

C.

Indexer acknowledgement.

D.

Index access permissions.

Question 25

The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data. What data model should be checked for potential errors such as skipped searches?

Options:

A.

Web

B.

Risk

C.

Performance

D.

Authentication

Question 26

Which of the following threat intelligence types can ES download? (Choose all that apply)

Options:

A.

Text

B.

STIX/TAXII

C.

VulnScanSPL

D.

Splunk Enterprise Threat Generator

Question 27

Which of the following features can the Add-on Builder configure in a new add-on?

Options:

A.

Expire data.

B.

Normalize data.

C.

Summarize data.

D.

Translate data.

Question 28

Who can delete an investigation?

Options:

A.

ess_admin users only.

B.

The investigation owner only.

C.

The investigation owner and ess-admin.

D.

The investigation owner and collaborators.

Question 29

“10.22.63.159”, “websvr4”, and “00:26:08:18: CF:1D” would be matched against what in ES?

Options:

A.

A user.

B.

A device.

C.

An asset.

D.

An identity.

Demo: 29 questions
Total 99 questions