Splunk SPLK-3001 Online Practice Questions and Exam Preparation

Splunk SPLK-3001 Online Questions & Answers

• Question 71:

  Which data model populated the panels on the Risk Analysis dashboard?

  A. Risk
  B. Audit
  C. Domain analysis
  D. Threat intelligence
  A. Risk

• Question 72:

  Which of the following threat intelligence types can ES download? (Choose all that apply)

  A. Text
  B. STIX/TAXII
  C. VulnScanSPL
  D. SplunkEnterpriseThreatGenerator
  A. Text
  B. STIX/TAXII

• Question 73:

  How is it possible to specify an alternate location for accelerated storage?

  A. Configure storage optimization settings for the index.
  B. Update the Home Path setting in indexes, conf
  C. Use the tstatsHomePath setting in props, conf
  D. Use the tstatsHomePath Setting in indexes, conf
  C. Use the tstatsHomePath setting in props, conf

• Question 74:

  What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?

  A. ess_user
  B. ess_admin
  C. ess_analyst
  D. ess_reviewer
  B. ess_admin

• Question 75:

  Which lookup table does the Default Account Activity Detected correlation search use to flag known default accounts?

  A. Administrative Identities
  B. Local User Intel
  C. Identities
  D. Privileged Accounts
  C. Identities

• Question 76:

  Adaptive response action history is stored in which index?

  A. cim_modactions
  B. modular_history
  C. cim_adaptiveactions
  D. modular_action_history
  A. cim_modactions

• Question 77:

  Which of the following is an adaptive action that is configured by default for ES?

  A. Create notable event
  B. Create new correlation search
  C. Create investigation
  D. Create new asset
  A. Create notable event

• Question 78:

  What is the default schedule for accelerating ES Datamodels?

  A. 1 minute
  B. 5 minutes
  C. 15 minutes
  D. 1 hour
  B. 5 minutes

• Question 79:

  How is it possible to navigate to the list of currently-enabled ES correlation searches?

  A. Configure -> Correlation Searches -> Select Status "Enabled"
  B. Settings -> Searches, Reports, and Alerts -> Filter by Name of "Correlation"
  C. Configure -> Content Management -> Select Type "Correlation" and Status "Enabled"
  D. Settings -> Searches, Reports, and Alerts -> Select App of "SplunkEnterpriseSecuritySuite" and filter by "-Rule"
  C. Configure -> Content Management -> Select Type "Correlation" and Status "Enabled"

• Question 80:

  How is it possible to navigate to the ES graphical Navigation Bar editor?

  A. Configure -> Navigation Menu
  B. Configure -> General -> Navigation
  C. Settings -> User Interface -> Navigation -> Click on "Enterprise Security"
  D. Settings -> User Interface -> Navigation Menus -> Click on "default" next to SplunkEnterpriseSecuritySuite
  B. Configure -> General -> Navigation