SPLK-3001 practice test

1. Question 1 · 1

   What is an example of an ES asset?

   Choose one answer.

   • MAC address
   • User name
   • People
   • Server

2. Question 2 · 1

   Analysts have requested the ability to capture and analyze network traffic data. The administrator has researched the documentation and, based on this research, has decided to integrate the Splunk App for Stream with ES. Which dashboards will now be supported so analysts can view and analyze network Stream data?

   Choose one answer.

   • Endpoint dashboards.
   • Protocol Intelligence dashboards.
   • User Intelligence dashboards.
   • Web Intelligence dashboards.

3. Question 3 · 1

   How is it possible to navigate to the list of currently-enabled ES correlation searches?

   Choose one answer.

   • Configure -> Correlation Searches -> Select Status ג€Enabledג€
   • Settings -> Searches, Reports, and Alerts -> Filter by Name of ג€Correlationג€
   • Configure -> Content Management -> Select Type ג€Correlationג€ and Status ג€Enabledג€
   • Settings -> Searches, Reports, and Alerts -> Select App of ג€SplunkEnterpriseSecuritySuiteג€ and filter by ג€-Ruleג€

4. Question 4 · 1

   Which of the following is a risk of using the Auto Deployment feature of Distributed Configuration Management to distribute indexes.conf?

   Choose one answer.

   • Indexers might crash.
   • Indexers might be processing.
   • Indexers might not be reachable.
   • Indexers have different settings.

5. Question 5 · 1

   At what point in the ES installation process should Splunk_TA_ForIndexers.spl be deployed to the indexers?

   Choose one answer.

   • When adding apps to the deployment server.
   • Splunk_TA_ForIndexers.spl is installed first.
   • After installing ES on the search head(s) and running the distributed configuration management tool.
   • Splunk_TA_ForIndexers.spl is only installed on indexer cluster sites using the cluster master and the splunk apply cluster-bundle command.

6. Question 6 · 1

   Which correlation search feature is used to throttle the creation of notable events?

   Choose one answer.

   • Schedule priority.
   • Window interval.
   • Window duration.
   • Schedule window.

7. Question 7 · 1

   Which of the following are examples of sources for events in the endpoint security domain dashboards?

   Choose one answer.

   • REST API invocations.
   • Investigation final results status.
   • Workstations, notebooks, and point-of-sale systems.
   • Lifecycle auditing of incidents, from assignment to resolution.

8. Question 8 · 1

   `10.22.63.159`, `websvr4`, and `00:26:08:18: CF:1D` would be matched against what in ES?

   Choose one answer.

   • A user.
   • A device.
   • An asset.
   • An identity.

9. Question 9 · 1

   How should an administrator add a new lookup through the ES app?

   Choose one answer.

   • Upload the lookup file in Settings -> Lookups -> Lookup Definitions
   • Upload the lookup file in Settings -> Lookups -> Lookup table files
   • Add the lookup file to /etc/apps/SplunkEnterpriseSecuritySuite/lookups
   • Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup

10. Question 10 · 1

    Which of the following is a key feature of a glass table?

    Choose one answer.

    • Rigidity.
    • Customization.
    • Interactive investigations.
    • Strong data for later retrieval.

11. Question 11 · 1

    An administrator is asked to configure an `Nslookup` adaptive response action, so that it appears as a selectable option in the notable event's action menu when an analyst is working in the Incident Review dashboard. What steps would the administrator take to configure this option?

    Choose one answer.

    • Configure -> Content Management -> Type: Correlation Search -> Notable -> Nslookup
    • Configure -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup
    • Configure -> Content Management -> Type: Correlation Search -> Notable -> Next Steps -> Nslookup
    • Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

12. Question 12 · 1

    What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

    Choose one answer.

    • Configure -> Incident Management -> Notable Event Statuses
    • Configure -> Content Management -> Type: Correlation Search
    • Configure -> Incident Management -> Incident Review Settings -> Event Management
    • Configure -> Incident Management -> Incident Review Settings -> Table Attributes

13. Question 13 · 1

    To observe what network services are in use in a network's activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?

    Choose one answer.

    • Intrusion Center
    • Protocol Analysis
    • User Intelligence
    • Threat Intelligence

14. Question 14 · 1

    Adaptive response action history is stored in which index?

    Choose one answer.

    • cim_modactions
    • modular_history
    • cim_adaptiveactions
    • modular_action_history

15. Question 15 · 1

    When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

    Choose one answer.

    • $fieldname$
    • ג€fieldnameג€
    • %fieldname%
    • _fieldname_

Paid access to all 52 questions

Each purchase applies to this certification. Prices are one-time payments, not monthly subscriptions.