Splunk SPLK-3001 Online Practice Questions and Exam Preparation

Splunk SPLK-3001 Online Questions & Answers

• Question 91:

  ES needs to be installed on a search head with which of the following options?

  A. No other apps.
  B. Any other apps installed.
  C. All apps removed except for TA-*.
  D. Only default built-in and CIM-compliant apps.
  D. Only default built-in and CIM-compliant apps.

• Question 92:

  Where should an ES search head be installed?

  A. On a Splunk server with top level visibility.
  B. On any Splunk server.
  C. On a server with a new install of Splunk.
  D. On a Splunk server running Splunk DB Connect.
  B. On any Splunk server.

• Question 93:

  Glass tables can display static images and text, the results of ad-hoc searches, and which of the following objects?

  A. Lookup searches.
  B. Summarized data.
  C. Security metrics.
  D. Metrics store searches.
  C. Security metrics.

• Question 94:

  Which columns in the Assets lookup are used to identify an asset in an event?

  A. src, dvc, dest
  B. cidr, port, netbios, saml
  C. ip, mac, dns, nt_host
  D. host, hostname, url, address
  C. ip, mac, dns, nt_host

• Question 95:

  Which of the following lookup types in Enterprise Security contains information about known hostile IP addresses?

  A. Security domains.
  B. Threat intel.
  C. Assets.
  D. Domains.
  B. Threat intel.

• Question 96:

  How does ES know local customer domain names so it can detect internal vs. external emails?

  A. Web and email domain names are set in General -> General Configuration.
  B. ES uses the User Activity index and applies machine learning to determine internal and external domains.
  C. The Corporate Web and Email Domain Lookups are edited during initial configuration.
  D. ES extracts local email and web domains automatically from SMTP and HTTP logs.
  C. The Corporate Web and Email Domain Lookups are edited during initial configuration.

• Question 97:

  If a username does not match the `identity' column in the identities list, which column is checked next?

  A. Email.
  B. Nickname
  C. IP address.
  D. Combination of Last Name, First Name.
  A. Email.

• Question 98:

  When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

  A. $fieldname$
  B. "fieldname"
  C. %fieldname%
  D. _fieldname_
  A. $fieldname$

• Question 99:

  What does the risk framework add to an object (user, server or other type) to indicate increased risk?

  A. An urgency.
  B. A risk profile.
  C. An aggregation.
  D. A numeric score.
  D. A numeric score.