Splunk Splunk Enterprise Security Certified Admin SPLK-3001 Questions & Answers

• Question 21:

  What is an example of an ES asset?

  A. MAC address

  B. User name

  C. Server

  D. People

  Correct Answer: A

• Question 22:

  Which of the following actions may be necessary before installing ES?

  A. Redirect distributed search connections.

  B. Purge KV Store.

  C. Add additional indexers.

  D. Add additional forwarders.

  Correct Answer: C

• Question 23:

  An administrator is provisioning one search head prior to installing ES. What are the reference minimum requirements for OS, CPU, and RAM for that machine?

  A. OS: 32 bit, RAM: 16 MB, CPU: 12 cores

  B. OS: 64 bit, RAM: 32 MB, CPU: 12 cores

  C. OS: 64 bit, RAM: 12 MB, CPU: 16 cores

  D. OS: 64 bit, RAM: 32 MB, CPU: 16 cores

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Capacity/Referencehardware

• Question 24:

  Which of the following is a way to test for a property normalized data model?

  A. Use Audit -> Normalization Audit and check the Errors panel.

  B. Run a | datamodel search, compare results to the CIM documentation for the datamodel.

  C. Run a | loadjob search, look at tag values and compare them to known tags based on the encoding.

  D. Run a | datamodel search and compare the results to the list of data models in the ES normalization guide.

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime

• Question 25:

  A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?

  A. Install ES on the existing search head.

  B. Add a new search head and install ES on it.

  C. Increase the number of CPUs and amount of memory on the search head, then install ES.

  D. Delete the non-CIM-compliant apps from the search head, then install ES.

  Correct Answer: B

  Reference: https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf

• Question 26:

  Which of the following is a recommended pre-installation step?

  A. Disable the default search app.

  B. Configure search head forwarding.

  C. Download the latest version of KV Store from MongoDBxom.

  D. Install the latest Python distribution on the search head.

  Correct Answer: B

• Question 27:

  What does the Security Posture dashboard display?

  A. Active investigations and their status.

  B. A high-level overview of notable events.

  C. Current threats being tracked by the SOC.

  D. A display of the status of security tools.

  Correct Answer: B

  The Security Posture dashboard is designed to provide high-level insight into the notable events across all domains of your deployment, suitable for display in a Security Operations Center (SOC). This dashboard

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/SecurityPosturedashboard

• Question 28:

  What is the maximum recommended volume of indexing per day, per indexer, for a non-cloud (on-prem) ES deployment?

  A. 50 GB

  B. 100 GB

  C. 300 GB

  D. 500 MB

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/ITSI/4.4.2/Install/Plan

• Question 29:

  Which of the following is an adaptive action that is configured by default for ES?

  A. Create notable event

  B. Create new correlation search

  C. Create investigation

  D. Create new asset

  Correct Answer: A

• Question 30:

  How is it possible to specify an alternate location for accelerated storage?

  A. Configure storage optimization settings for the index.

  B. Update the Home Path setting in indexes, conf

  C. Use the tstatsHomePath setting in props, conf

  D. Use the tstatsHomePath Setting in indexes, conf

  Correct Answer: C