Splunk Splunk Enterprise Security Certified Admin SPLK-3001 Questions & Answers

• Question 11:

  Following the Installation of ES, an admin configured Leers with the ﹕s_uso r role the ability to close notable events. How would the admin restrict these users from being able to change the status of Resolved notable events to closed?

  A. From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the closed status.

  B. From the Status Configuration windows select the closed status. Remove ess_use r from the status transitions for the Resolved status.

  C. In Enterprise Security, give the ess_user role the own Notable Events permission.

  D. From Splunk Access Controls, select the ess_user role and remove the edit_notabie_events capability.

  Correct Answer: B

• Question 12:

  At what point in the ES installation process should Splunk_TA_ForIndexes.spl be deployed to the indexers?

  A. When adding apps to the deployment server.

  B. Splunk_TA_ForIndexers.spl is installed first.

  C. After installing ES on the search head(s) and running the distributed configuration management tool.

  D. Splunk_TA_ForIndexers.spl is only installed on indexer cluster sites using the cluster master and the splunk apply cluster-bundle command.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Install/InstallTechnologyAdd-ons

• Question 13:

  A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.

  Which of the following options is most likely to help performance?

  A. Change the search heads to do local indexing of summary searches.

  B. Add heavy forwarders between the universal forwarders and indexers so inputs can be parsed before indexing.

  C. Increase memory and CPUs on the search head(s) and add additional indexers.

  D. If indexed realtime search is enabled, disable it for the notable index.

  Correct Answer: C

• Question 14:

  Which of the following actions would not reduce the number of false positives from a correlation search?

  A. Reducing the severity.

  B. Removing throttling fields.

  C. Increasing the throttling window.

  D. Increasing threshold sensitivity.

  Correct Answer: A

• Question 15:

  What kind of value is in the red box in this picture?

  

  A. A risk score.

  B. A source ranking.

  C. An event priority.

  D. An IP address rating.

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/FormateventsforHTTPEventCollector

• Question 16:

  Which correlation search feature is used to throttle the creation of notable events?

  A. Schedule priority.

  B. Window interval.

  C. Window duration.

  D. Schedule windows.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Configurecorrelationsearches

• Question 17:

  Analysts have requested the ability to capture and analyze network traffic data. The administrator has researched the documentation and, based on this research, has decided to integrate the Splunk App for Stream with ES.

  Which dashboards will now be supported so analysts can view and analyze network Stream data?

  A. Endpoint dashboards.

  B. User Intelligence dashboards.

  C. Protocol Intelligence dashboards.

  D. Web Intelligence dashboards.

  Correct Answer: C

• Question 18:

  What can be exported from ES using the Content Management page?

  A. Only correlation searches, managed lookups, and glass tables.

  B. Only correlation searches.

  C. Any content type listed in the Content Management page.

  D. Only correlation searches, glass tables, and workbench panels.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Export#:~:text=as%20an%20app-,Export% 20content%20from%20Splunk%20Enterprise%20Security%20as,from%20the%20Conte nt% 20Management%20page.andtext=You%20can%20export%20any%20type,%2C%20data%20models%2C%2 0and%20views.

• Question 19:

  Which indexes are searched by default for CIM data models?

  A. notable and default

  B. summary and notable

  C. _internal and summary

  D. All indexes

  Correct Answer: D

  Reference: https://answers.splunk.com/answers/600354/indexes-searched-by-cim-data-models.html

• Question 20:

  What do threat gen searches produce?

  A. Threat Intel in KV Store collections.

  B. Threat correlation searches.

  C. Threat notables in the notable index.

  D. Events in the threat_activity index.

  Correct Answer: D

  https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Createthreatmatchspecs