Splunk SPLK-3001 Online Practice Questions and Exam Preparation

Splunk SPLK-3001 Online Questions & Answers

• Question 21:

  Which of these Is a benefit of data normalization?

  A. Reports run faster because normalized data models can be optimized for better performance.
  B. Dashboards take longer to build.
  C. Searches can be built no matter the specific source technology for a normalized data type.
  D. Forwarder-based inputs are more efficient.
  A. Reports run faster because normalized data models can be optimized for better performance.

• Question 22:

  A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.

  Which of the following options is most likely to help performance?

  A. Change the search heads to do local indexing of summary searches.
  B. Add heavy forwarders between the universal forwarders and indexers so inputs can be parsed before indexing.
  C. Increase memory and CPUs on the search head(s) and add additional indexers.
  D. If indexed realtime search is enabled, disable it for the notable index.
  C. Increase memory and CPUs on the search head(s) and add additional indexers.

• Question 23:

  When installing Enterprise Security, what should be done after installing the add-ons necessary for normalizing data?

  A. Configure the add-ons according to their README or documentation.
  B. Disable the add-ons until they are ready to be used, then enable the add-ons.
  C. Nothing, there are no additional steps for add-ons.
  D. Configure the add-ons via the Content Management dashboard.
  A. Configure the add-ons according to their README or documentation.

• Question 24:

  What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

  A. Configure -> Incident Management -> Notable Event Statuses
  B. Configure -> Content Management -> Type: Correlation Search
  C. Configure -> Incident Management -> Incident Review Settings -> Event Management
  D. Configure -> Incident Management -> Incident Review Settings -> Table Attributes
  D. Configure -> Incident Management -> Incident Review Settings -> Table Attributes

• Question 25:

  Which of the following features can the Add-on Builder configure in a new add-on?

  A. Expire data.
  B. Normalize data.
  C. Summarize data.
  D. Translate data.
  B. Normalize data.

• Question 26:

  Which of the following actions can improve overall search performance?

  A. Disable indexed real-time search.
  B. Increase priority of all correlation searches.
  C. Reduce the frequency (schedule) of lower-priority correlation searches.
  D. Add notable event suppressions for correlation searches with high numbers of false positives.
  A. Disable indexed real-time search.

• Question 27:

  A set of correlation searches are enabled at a new ES installation, and results are being monitored. One of the correlation searches is generating many notable events which, when evaluated, are determined to be false positives. What is a solution for this issue?

  A. Suppress notable events from that correlation search.
  B. Disable acceleration for the correlation search to reduce storage requirements.
  C. Modify the correlation schedule and sensitivity for your site.
  D. Change the correlation search's default status and severity.
  A. Suppress notable events from that correlation search.

• Question 28:

  "10.22.63.159", "websvr4", and "00:26:08:18: CF:1D" would be matched against what in ES?

  A. A user.
  B. A device.
  C. An asset.
  D. An identity.
  B. A device.

• Question 29:

  After data is ingested, which data management step is essential to ensure raw data can be accelerated by a Data Model and used by ES?

  A. Applying Tags.
  B. Normalization to Customer Standard.
  C. Normalization to the Splunk Common Information Model.
  D. Extracting Fields.
  C. Normalization to the Splunk Common Information Model.

• Question 30:

  Which of the following would allow an add-on to be automatically imported into Splunk Enterprise Security?

  A. A prefix of CIM_
  B. A suffix of .spl
  C. A prefix of TECH_
  D. A prefix of Splunk_TA_
  D. A prefix of Splunk_TA_