Splunk SPLK-3001 Online Practice Questions and Exam Preparation

Splunk SPLK-3001 Online Questions & Answers

• Question 1:

  Which of the following actions would not reduce the number of false positives from a correlation search?

  A. Reducing the severity.
  B. Removing throttling fields.
  C. Increasing the throttling window.
  D. Increasing threshold sensitivity.
  A. Reducing the severity.

• Question 2:

  What tools does the Risk Analysis dashboard provide?

  A. High risk threats.
  B. Notable event domains displayed by risk score.
  C. A display of the highest risk assets and identities.
  D. Key indicators showing the highest probability correlation searches in the environment.
  C. A display of the highest risk assets and identities.

• Question 3:

  Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

  A. SplunkWeb (8068), Splunk Management (8089), KV Store (8000)
  B. SplunkWeb (8390), Splunk Management (8323), KV Store (8672)
  C. SplunkWeb (8000), Splunk Management (8089), KV Store (8191)
  D. SplunkWeb (8043), Splunk Management (8088), KV Store (8191)
  C. SplunkWeb (8000), Splunk Management (8089), KV Store (8191)

• Question 4:

  Which setting is used in indexes.conf to specify alternate locations for accelerated storage?

  A. thawedPath
  B. tstatsHomePath
  C. summaryHomePath
  D. warmToColdScript
  B. tstatsHomePath

• Question 5:

  A security manager has been working with the executive team en long-range security goals. A primary goal for the team Is to Improve managing user risk in the organization. Which of the following ES features can help identify users accessing inappropriate web sites?

  A. Configuring the identities lookup with user details to enrich notable event Information for forensic analysis.
  B. Make sure the Authentication data model contains up-to-date events and is properly accelerated.
  C. Configuring user and website watchlists so the User Activity dashboard will highlight unwanted user actions.
  D. Use the Access Anomalies dashboard to identify unusual protocols being used to access corporate sites.
  C. Configuring user and website watchlists so the User Activity dashboard will highlight unwanted user actions.

• Question 6:

  Which of the following is a Web Intelligence dashboard?

  A. Network Center
  B. Endpoint Center
  C. HTTP Category Analysis
  D. stream :http Protocol dashboard
  C. HTTP Category Analysis

• Question 7:

  Both "Recommended Actions" and "Adaptive Response Actions" use adaptive response. How do they differ?

  A. Recommended Actions show a textual description to an analyst, Adaptive Response Actions show them encoded.
  B. Recommended Actions show a list of Adaptive Responses to an analyst, Adaptive Response Actions run them automatically.
  C. Recommended Actions show a list of Adaptive Responses that have already been run, Adaptive Response Actions run them automatically.
  D. Recommended Actions show a list of Adaptive Resposes to an analyst, Adaptive Response Actions run manually with analyst intervention.
  D. Recommended Actions show a list of Adaptive Resposes to an analyst, Adaptive Response Actions run manually with analyst intervention.

• Question 8:

  Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events.

  How would the admin restrict these users from being able to change the status of Resolved notable events to Closed?

  A. In Enterprise Security, give the ess_user role the Own Notable Events permission.
  B. From the Status Configuration window select the Closed status. Remove ess_user from the status transitions for the Resolved status.
  C. From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the Closed status.
  D. From Splunk Access Controls, select the ess_user role and remove the edit_notable_events capability.
  C. From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the Closed status.

• Question 9:

  Which of the following ES features would a security analyst use while investigating a network anomaly notable?

  A. Correlation editor.
  B. Key indicator search.
  C. Threat download dashboard.
  D. Protocol intelligence dashboard.
  D. Protocol intelligence dashboard.

• Question 10:

  Which of the following are data models used by ES? (Choose all that apply)

  A. Web
  B. Anomalies
  C. Authentication
  D. Network Traffic
  A. Web
  C. Authentication
  D. Network Traffic