Splunk SPLK-3001 Online Practice Questions and Exam Preparation

Splunk SPLK-3001 Online Questions & Answers

• Question 31:

  Which of the following is a way to test for a property normalized data model?

  A. Use Audit -> Normalization Audit and check the Errors panel.
  B. Run a | datamodel search, compare results to the CIM documentation for the datamodel.
  C. Run a | loadjob search, look at tag values and compare them to known tags based on the encoding.
  D. Run a | datamodel search and compare the results to the list of data models in the ES normalization guide.
  B. Run a | datamodel search, compare results to the CIM documentation for the datamodel.

• Question 32:

  What is the maximum recommended volume of indexing per day, per indexer, for a non-cloud (on-prem) ES deployment?

  A. 50 GB
  B. 100 GB
  C. 300 GB
  D. 500 MB
  B. 100 GB

• Question 33:

  Which feature contains scenarios that are useful during ES Implementation?

  A. Use Case Library
  B. Correlation Searches
  C. Predictive Analytics
  D. Adaptive Responses
  B. Correlation Searches

• Question 34:

  Which component normalizes events?

  A. SA-CIM.
  B. SA-Notable.
  C. ES application.
  D. Technology add-on.
  A. SA-CIM.

• Question 35:

  Which of the following is a recommended pre-installation step?

  A. Disable the default search app.
  B. Configure search head forwarding.
  C. Download the latest version of KV Store from MongoDBxom.
  D. Install the latest Python distribution on the search head.
  B. Configure search head forwarding.

• Question 36:

  What does the Security Posture dashboard display?

  A. Active investigations and their status.
  B. A high-level overview of notable events.
  C. Current threats being tracked by the SOC.
  D. A display of the status of security tools.
  B. A high-level overview of notable events.

• Question 37:

  At what point in the ES installation process should Splunk_TA_ForIndexes.spl be deployed to the indexers?

  A. When adding apps to the deployment server.
  B. Splunk_TA_ForIndexers.spl is installed first.
  C. After installing ES on the search head(s) and running the distributed configuration management tool.
  D. Splunk_TA_ForIndexers.spl is only installed on indexer cluster sites using the cluster master and the splunk apply cluster-bundle command.
  C. After installing ES on the search head(s) and running the distributed configuration management tool.

• Question 38:

  What are adaptive responses triggered by?

  A. By correlation searches and users on the incident review dashboard.
  B. By correlation searches and custom tech add-ons.
  C. By correlation searches and users on the threat analysis dashboard.
  D. By custom tech add-ons and users on the risk analysis dashboard.
  D. By custom tech add-ons and users on the risk analysis dashboard.

• Question 39:

  The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated. How can the correlation search be made less sensitive?

  A. Edit the search and modify the notable event status field to make the notable events less urgent.
  B. Edit the search, look for where or xswhere statements, and after the threshold value being compared to make it less common match.
  C. Edit the search, look for where or xswhere statements, and alter the threshold value being compared to make it a more common match.
  D. Modify the urgency table for this correlation search and add a new severity level to make notable events from this search less urgent.
  B. Edit the search, look for where or xswhere statements, and after the threshold value being compared to make it less common match.

• Question 40:

  Which indexes are searched by default for CIM data models?

  A. notable and default
  B. summary and notable
  C. _internal and summary
  D. All indexes
  D. All indexes