Splunk SPLK-3001 Online Practice Questions and Exam Preparation

Splunk SPLK-3001 Online Questions & Answers

• Question 61:

  What kind of value is in the red box in this picture?

  

  A. A risk score.
  B. A source ranking.
  C. An event priority.
  D. An IP address rating.
  A. A risk score.

• Question 62:

  An administrator is provisioning one search head prior to installing ES. What are the reference minimum requirements for OS, CPU, and RAM for that machine?

  A. OS: 32 bit, RAM: 16 MB, CPU: 12 cores
  B. OS: 64 bit, RAM: 32 MB, CPU: 12 cores
  C. OS: 64 bit, RAM: 12 MB, CPU: 16 cores
  D. OS: 64 bit, RAM: 32 MB, CPU: 16 cores
  C. OS: 64 bit, RAM: 12 MB, CPU: 16 cores

• Question 63:

  A newly built custom dashboard needs to be available to a team of security analysts In ES. How is It possible to Integrate the new dashboard?

  A. Add links on the ES home page to the new dashboard.
  B. Create a new role Inherited from es_analyst, make the dashboard permissions read-only, and make this dashboard the default view for the new role.
  C. Set the dashboard permissions to allow access by es_analysts and use the navigation editor to add it to the menu.
  D. Add the dashboard to a custom add-in app and install it to ES using the Content Manager.
  C. Set the dashboard permissions to allow access by es_analysts and use the navigation editor to add it to the menu.

• Question 64:

  Which of the following are examples of sources for events in the endpoint security domain dashboards?

  A. REST API invocations.
  B. Investigation final results status.
  C. Workstations, notebooks, and point-of-sale systems.
  D. Lifecycle auditing of incidents, from assignment to resolution.
  C. Workstations, notebooks, and point-of-sale systems.

• Question 65:

  What can be exported from ES using the Content Management page?

  A. Only correlation searches, managed lookups, and glass tables.
  B. Only correlation searches.
  C. Any content type listed in the Content Management page.
  D. Only correlation searches, glass tables, and workbench panels.
  C. Any content type listed in the Content Management page.

• Question 66:

  When using distributed configuration management to create the Splunk_TA_ForIndexers package, which three files can be included?

  A. indexes.conf, props.conf, transforms.conf
  B. web.conf, props.conf, transforms.conf
  C. inputs.conf, props.conf, transforms.conf
  D. eventtypes.conf, indexes.conf, tags.conf
  A. indexes.conf, props.conf, transforms.conf

• Question 67:

  What is the main purpose of the Dashboard Requirements Matrix document?

  A. Identifies on which data model(s) each dashboard depends.
  B. Provides instructions for customizing each dashboard for local data models.
  C. Identifies the searches used by the dashboards.
  D. Identifies which data model(s) depend on each dashboard.
  D. Identifies which data model(s) depend on each dashboard.

• Question 68:

  Accelerated data requires approximately how many times the daily data volume of additional storage space per year?

  A. 3.4
  B. 5.7
  C. 1.0
  D. 2.5
  A. 3.4

• Question 69:

  A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?

  A. Install ES on the existing search head.
  B. Add a new search head and install ES on it.
  C. Increase the number of CPUs and amount of memory on the search head, then install ES.
  D. Delete the non-CIM-compliant apps from the search head, then install ES.
  B. Add a new search head and install ES on it.

• Question 70:

  Which of the following is a key feature of a glass table?

  A. Rigidity.
  B. Customization.
  C. Interactive investigations.
  D. Strong data for later retrieval.
  B. Customization.