Splunk SPLK-3001 Online Practice Questions and Exam Preparation

Splunk SPLK-3001 Online Questions & Answers

• Question 11:

  Where is it possible to export content, such as correlation searches, from ES?

  A. Content exporter
  B. Configure -> Content Management
  C. Export content dashboard
  D. Settings Menu -> ES -> Export
  B. Configure -> Content Management

• Question 12:

  Which column in the Asset or Identity list is combined with event security to make a notable event's urgency?

  A. VIP
  B. Priority
  C. Importance
  D. Criticality
  B. Priority

• Question 13:

  ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

  A. $SPLUNK_HOME/etc/master-apps/
  B. $SPLUNK_HOME/etc/system/local/
  C. $SPLUNK_HOME/etc/shcluster/apps
  D. $SPLUNK_HOME/var/run/searchpeers/
  C. $SPLUNK_HOME/etc/shcluster/apps

• Question 14:

  The Add-On Builder creates Splunk Apps that start with what?

  A. DA
  B. SA
  C. TA
  D. App-
  C. TA

• Question 15:

  Which of the following steps will make the Threat Activity dashboard the default landing page in ES?

  A. From the Edit Navigation page, drag and drop the Threat Activity view to the top of the page.
  B. From the Preferences menu for the user, select Enterprise Security as the default application.
  C. From the Edit Navigation page, click the 'Set this as the default view" checkmark for Threat Activity.
  D. Edit the Threat Activity view settings and checkmark the Default View option.
  C. From the Edit Navigation page, click the 'Set this as the default view" checkmark for Threat Activity.

• Question 16:

  Which correlation search feature is used to throttle the creation of notable events?

  A. Schedule priority.
  B. Window interval.
  C. Window duration.
  D. Schedule windows.
  C. Window duration.

• Question 17:

  Which of the following is part of tuning correlation searches for a new ES installation?

  A. Configuring correlation notable event index.
  B. Configuring correlation permissions.
  C. Configuring correlation adaptive responses.
  D. Configuring correlation result storage.
  A. Configuring correlation notable event index.

• Question 18:

  After installing Enterprise Security, the distributed configuration management tool can be used to create which app to configure indexers?

  A. Splunk_DS_ForIndexers.spl
  B. Splunk_ES_ForIndexers.spl
  C. Splunk_SA_ForIndexers.spl
  D. Splunk_TA_ForIndexers.spl
  D. Splunk_TA_ForIndexers.spl

• Question 19:

  Where is detailed information about identities stored?

  A. The Identity Investigator index.
  B. The Access Anomalies collection.
  C. The User Activity index.
  D. The Identity Lookup CSV file.
  C. The User Activity index.

• Question 20:

  Enterprise Security's dashboards primarily pull data from what type of knowledge object?

  A. Tstats
  B. KV Store
  C. Data models
  D. Dynamic lookups
  C. Data models