Splunk SPLK-3001 Online Practice Questions and Exam Preparation

Splunk SPLK-3001 Online Questions & Answers

• Question 81:

  What does the summariesonly=true option do for a correlation search?

  A. Searches only accelerated data.
  B. Forwards summary indexes to the indexing tier.
  C. Uses a default summary time range.
  D. Searches summary indexes only.
  A. Searches only accelerated data.

• Question 82:

  Where is the Add-On Builder available from?

  A. GitHub
  B. SplunkBase
  C. www.splunk.com
  D. The ES installation package
  B. SplunkBase

• Question 83:

  Where are attachments to investigations stored?

  A. KV Store
  B. notable index
  C. attachments.csv lookup
  D. /etc/apps/SA-Investigations/default/ui/views/attachments
  A. KV Store

• Question 84:

  What is the bar across the bottom of any ES window?

  A. The Investigator Workbench.
  B. The Investigation Bar.
  C. The Analyst Bar.
  D. The Compliance Bar.
  B. The Investigation Bar.

• Question 85:

  Who can delete an investigation?

  A. ess_admin users only.
  B. The investigation owner only.
  C. The investigation owner and ess-admin.
  D. The investigation owner and collaborators.
  A. ess_admin users only.

• Question 86:

  When investigating, what is the best way to store a newly-found IOC?

  A. Paste it into Notepad.
  B. Click the "Add IOC" button.
  C. Click the "Add Artifact" button.
  D. Add it in a text note to the investigation.
  C. Click the "Add Artifact" button.

• Question 87:

  Which two fields combine to create the Urgency of a notable event?

  A. Priority and Severity.
  B. Priority and Criticality.
  C. Criticality and Severity.
  D. Precedence and Time.
  A. Priority and Severity.

• Question 88:

  Which argument to the | tstats command restricts the search to summarized data only?

  A. summaries=t
  B. summaries=all
  C. summariesonly=t
  D. summariesonly=all
  C. summariesonly=t

• Question 89:

  The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data. What data model should be checked for potential errors such as skipped searches?

  A. Web
  B. Risk
  C. Performance
  D. Authentication
  D. Authentication

• Question 90:

  Analysts have requested the ability to capture and analyze network traffic data. The administrator has researched the documentation and, based on this research, has decided to integrate the Splunk App for Stream with ES. Which dashboards will now be supported so analysts can view and analyze network Stream data?

  A. Endpoint dashboards.
  B. User Intelligence dashboards.
  C. Protocol Intelligence dashboards.
  D. Web Intelligence dashboards.
  C. Protocol Intelligence dashboards.