Splunk Splunk Enterprise Security Certified Admin SPLK-3001 Questions & Answers

• Question 91:

  The Add-On Builder creates Splunk Apps that start with what?

  A. DA

  B. SA

  C. TA

  D. App-

  Correct Answer: C

  Reference: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/abouttheessolution/

• Question 92:

  Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

  A. SplunkWeb (8068), Splunk Management (8089), KV Store (8000)

  B. SplunkWeb (8390), Splunk Management (8323), KV Store (8672)

  C. SplunkWeb (8000), Splunk Management (8089), KV Store (8191)

  D. SplunkWeb (8043), Splunk Management (8088), KV Store (8191)

  Correct Answer: C

  https://docs.splunk.com/Documentation/Splunk/8.1.2/Security/SecureSplunkonyournetwork

• Question 93:

  What feature of Enterprise Security downloads threat intelligence data from a web server?

  A. Threat Service Manager

  B. Threat Download Manager

  C. Threat Intelligence Parser

  D. Therat Intelligence Enforcement

  Correct Answer: B

  "The Threat Intelligence Framework provides a modular input (Threat Intelligence Downloads) that handles the majority of configurations typically needed for downloading intelligence files and data. To access this modular input, you simply need to create a stanza in your Inputs.conf file called "threatlist"."

• Question 94:

  Where is detailed information about identities stored?

  A. The Identity Investigator index.

  B. The Access Anomalies collection.

  C. The User Activity index.

  D. The Identity Lookup CSV file.

  Correct Answer: C

• Question 95:

  A set of correlation searches are enabled at a new ES installation, and results are being monitored. One of the correlation searches is generating many notable events which, when evaluated, are determined to be false positives.

  What is a solution for this issue?

  A. Suppress notable events from that correlation search.

  B. Disable acceleration for the correlation search to reduce storage requirements.

  C. Modify the correlation schedule and sensitivity for your site.

  D. Change the correlation search's default status and severity.

  Correct Answer: A

• Question 96:

  What is the bar across the bottom of any ES window?

  A. The Investigator Workbench.

  B. The Investigation Bar.

  C. The Analyst Bar.

  D. The Compliance Bar.

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/ES/6.4.1/User/Startaninvestigation

• Question 97:

  Which of these Is a benefit of data normalization?

  A. Reports run faster because normalized data models can be optimized for better performance.

  B. Dashboards take longer to build.

  C. Searches can be built no matter the specific source technology for a normalized data type.

  D. Forwarder-based inputs are more efficient.

  Correct Answer: A

• Question 98:

  Which two fields combine to create the Urgency of a notable event?

  A. Priority and Severity.

  B. Priority and Criticality.

  C. Criticality and Severity.

  D. Precedence and Time.

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/ES/6.4.1/User/Howurgencyisassigned

• Question 99:

  What is the main purpose of the Dashboard Requirements Matrix document?

  A. Identifies on which data model(s) each dashboard depends.

  B. Provides instructions for customizing each dashboard for local data models.

  C. Identifies the searches used by the dashboards.

  D. Identifies which data model(s) depend on each dashboard.

  Correct Answer: D