Splunk Splunk Enterprise Security Certified Admin SPLK-3001 Questions & Answers

• Question 41:

  Which component normalizes events?

  A. SA-CIM.

  B. SA-Notable.

  C. ES application.

  D. Technology add-on.

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime

• Question 42:

  Which of the following are examples of sources for events in the endpoint security domain dashboards?

  A. REST API invocations.

  B. Investigation final results status.

  C. Workstations, notebooks, and point-of-sale systems.

  D. Lifecycle auditing of incidents, from assignment to resolution.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/EndpointProtectionDomaindashboards

• Question 43:

  Which of the following is a Web Intelligence dashboard?

  A. Network Center

  B. Endpoint Center

  C. HTTP Category Analysis

  D. stream :http Protocol dashboard

  Correct Answer: C

• Question 44:

  The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated. How can the correlation search be made less sensitive?

  A. Edit the search and modify the notable event status field to make the notable events less urgent.

  B. Edit the search, look for where or xswhere statements, and after the threshold value being compared to make it less common match.

  C. Edit the search, look for where or xswhere statements, and alter the threshold value being compared to make it a more common match.

  D. Modify the urgency table for this correlation search and add a new severity level to make notable events from this search less urgent.

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Howurgencyisassigned

• Question 45:

  Which feature contains scenarios that are useful during ES Implementation?

  A. Use Case Library

  B. Correlation Searches

  C. Predictive Analytics

  D. Adaptive Responses

  Correct Answer: B

  Reference: https://www.splunk.com/pdfs/professional-services/2019/splunk-enterprise-securityimplementation-success.pdf

• Question 46:

  When using distributed configuration management to create the Splunk_TA_ForIndexers package, which three files can be included?

  A. indexes.conf, props.conf, transforms.conf

  B. web.conf, props.conf, transforms.conf

  C. inputs.conf, props.conf, transforms.conf

  D. eventtypes.conf, indexes.conf, tags.conf

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/ES/6.4.1/Install/InstallTechnologyAdd-ons

• Question 47:

  "10.22.63.159", "websvr4", and "00:26:08:18: CF:1D" would be matched against what in ES?

  A. A user.

  B. A device.

  C. An asset.

  D. An identity.

  Correct Answer: B

• Question 48:

  In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?

  A. Save the settings.

  B. Apply the correct tags.

  C. Run the correct search.

  D. Visit the CIM dashboard.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizeOSSECdata

• Question 49:

  Which of the following actions can improve overall search performance?

  A. Disable indexed real-time search.

  B. Increase priority of all correlation searches.

  C. Reduce the frequency (schedule) of lower-priority correlation searches.

  D. Add notable event suppressions for correlation searches with high numbers of false positives.

  Correct Answer: A

• Question 50:

  What should be used to map a non-standard field name to a CIM field name?

  A. Field alias.

  B. Search time extraction.

  C. Tag.

  D. Eventtype.

  Correct Answer: A