Splunk SPLK-3001 Online Practice Questions and Exam Preparation

Splunk SPLK-3001 Online Questions & Answers

• Question 51:

  After managing source types and extracting fields, which key step comes next In the Add-On Builder?

  A. Validate and package
  B. Configure data collection.
  C. Create alert actions.
  D. Map to data models.
  D. Map to data models.

• Question 52:

  What is the first step when preparing to install ES?

  A. Install ES.
  B. Determine the data sources used.
  C. Determine the hardware required.
  D. Determine the size and scope of installation.
  D. Determine the size and scope of installation.

• Question 53:

  Following the Installation of ES, an admin configured Leers with the ﹕s_uso r role the ability to close notable events. How would the admin restrict these users from being able to change the status of Resolved notable events to closed?

  A. From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the closed status.
  B. From the Status Configuration windows select the closed status. Remove ess_use r from the status transitions for the Resolved status.
  C. In Enterprise Security, give the ess_user role the own Notable Events permission.
  D. From Splunk Access Controls, select the ess_user role and remove the edit_notabie_events capability.
  B. From the Status Configuration windows select the closed status. Remove ess_use r from the status transitions for the Resolved status.

• Question 54:

  Which of the following is a risk of using the Auto Deployment feature of Distributed Configuration Management to distribute indexes.conf?

  A. Indexes might crash.
  B. Indexes might be processing.
  C. Indexes might not be reachable.
  D. Indexes have different settings.
  A. Indexes might crash.

• Question 55:

  What feature of Enterprise Security downloads threat intelligence data from a web server?

  A. Threat Service Manager
  B. Threat Download Manager
  C. Threat Intelligence Parser
  D. Therat Intelligence Enforcement
  B. Threat Download Manager

• Question 56:

  What should be used to map a non-standard field name to a CIM field name?

  A. Field alias.
  B. Search time extraction.
  C. Tag.
  D. Eventtype.
  A. Field alias.

• Question 57:

  Which tool Is used to update indexers In E5?

  A. Index Updater
  B. Distributed Configuration Management
  C. indexes.conf
  D. Splunk_TA_ForIndexeres. spl
  B. Distributed Configuration Management

• Question 58:

  To which of the following should the ES application be uploaded?

  A. The indexer.
  B. The KV Store.
  C. The search head.
  D. The dedicated forwarder.
  C. The search head.

• Question 59:

  The option to create a Short ID for a notable event is located where?

  A. The Additional Fields.
  B. The Event Details.
  C. The Contributing Events.
  D. The Description.
  B. The Event Details.

• Question 60:

  How is notable event urgency calculated?

  A. Asset priority and threat weight.
  B. Alert severity found by the correlation search.
  C. Asset or identity risk and severity found by the correlation search.
  D. Severity set by the correlation search and priority assigned to the associated asset or identity.
  D. Severity set by the correlation search and priority assigned to the associated asset or identity.