Splunk SPLK-3001 Online Practice Questions and Exam Preparation

Splunk SPLK-3001 Online Questions & Answers

• Question 41:

  To observe what network services are in use in a network's activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?

  A. Intrusion Center
  B. Protocol Analysis
  C. User Intelligence
  D. Threat Intelligence
  B. Protocol Analysis

• Question 42:

  Which of the following actions may be necessary before installing ES?

  A. Redirect distributed search connections.
  B. Purge KV Store.
  C. Add additional indexers.
  D. Add additional forwarders.
  C. Add additional indexers.

• Question 43:

  What is an example of an ES asset?

  A. MAC address
  B. User name
  C. Server
  D. People
  A. MAC address

• Question 44:

  When ES content is exported, an app with a .spl extension is automatically created. What is the best practice when exporting and importing updates to ES content?

  A. Use new app names each time content is exported.
  B. Do not use the .spl extension when naming an export.
  C. Always include existing and new content for each export.
  D. Either use new app names or always include both existing and new content.
  D. Either use new app names or always include both existing and new content.

• Question 45:

  How should an administrator add a new lookup through the ES app?

  A. Upload the lookup file in Settings -> Lookups -> Lookup Definitions
  B. Upload the lookup file in Settings -> Lookups -> Lookup table files
  C. Add the lookup file to /etc/apps/SplunkEnterpriseSecuritySuite/lookups
  D. Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup
  D. Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup

• Question 46:

  Which settings indicated that the correlation search will be executed as new events are indexed?

  A. Always-On
  B. Real-Time
  C. Scheduled
  D. Continuous
  C. Scheduled

• Question 47:

  In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?

  A. Save the settings.
  B. Apply the correct tags.
  C. Run the correct search.
  D. Visit the CIM dashboard.
  C. Run the correct search.

• Question 48:

  What do threat gen searches produce?

  A. Threat Intel in KV Store collections.
  B. Threat correlation searches.
  C. Threat notables in the notable index.
  D. Events in the threat_activity index.
  D. Events in the threat_activity index.

• Question 49:

  An administrator wants to ensure that none of the ES indexed data could be compromised through tampering. What feature would satisfy this requirement?

  A. Index consistency.
  B. Data integrity control.
  C. Indexer acknowledgement.
  D. Index access permissions.
  B. Data integrity control.

• Question 50:

  An administrator is asked to configure an "Nslookup" adaptive response action, so that it appears as a selectable option in the notable event's action menu when an analyst is working in the Incident Review dashboard. What steps would the administrator take to configure this option?

  A. Configure -> Content Management -> Type: Correlation Search -> Notable -> Nslookup
  B. Configure -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup
  C. Configure -> Content Management -> Type: Correlation Search -> Notable -> Next Steps -> Nslookup
  D. Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup
  D. Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup