Splunk Splunk Enterprise Security Certified Admin SPLK-3001 Questions & Answers

• Question 81:

  Where is it possible to export content, such as correlation searches, from ES?

  A. Content exporter

  B. Configure -> Content Management

  C. Export content dashboard

  D. Settings Menu -> ES -> Export

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Export

• Question 82:

  After installing Enterprise Security, the distributed configuration management tool can be used to create which app to configure indexers?

  A. Splunk_DS_ForIndexers.spl

  B. Splunk_ES_ForIndexers.spl

  C. Splunk_SA_ForIndexers.spl

  D. Splunk_TA_ForIndexers.spl

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Install/InstallTechnologyAdd-ons

• Question 83:

  Which column in the Asset or Identity list is combined with event security to make a notable event's urgency?

  A. VIP

  B. Priority

  C. Importance

  D. Criticality

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Howurgencyisassigned

• Question 84:

  Which of the following would allow an add-on to be automatically imported into Splunk Enterprise Security?

  A. A prefix of CIM_

  B. A suffix of .spl

  C. A prefix of TECH_

  D. A prefix of Splunk_TA_

  Correct Answer: D

  Reference: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/planintegrationes/

• Question 85:

  What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?

  A. ess_user

  B. ess_admin

  C. ess_analyst

  D. ess_reviewer

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Triagenotableevents

• Question 86:

  What does the risk framework add to an object (user, server or other type) to indicate increased risk?

  A. An urgency.

  B. A risk profile.

  C. An aggregation.

  D. A numeric score.

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/RiskScoring

• Question 87:

  What does the summariesonly=true option do for a correlation search?

  A. Searches only accelerated data.

  B. Forwards summary indexes to the indexing tier.

  C. Uses a default summary time range.

  D. Searches summary indexes only.

  Correct Answer: A

  Reference: https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-do-correlation-searches-inEnterprise-Security-not-use-quot/m-p/262622

• Question 88:

  Which of the following steps will make the Threat Activity dashboard the default landing page in ES?

  A. From the Edit Navigation page, drag and drop the Threat Activity view to the top of the page.

  B. From the Preferences menu for the user, select Enterprise Security as the default application.

  C. From the Edit Navigation page, click the 'Set this as the default view" checkmark for Threat Activity.

  D. Edit the Threat Activity view settings and checkmark the Default View option.

  Correct Answer: C

• Question 89:

  Which lookup table does the Default Account Activity Detected correlation search use to flag known default accounts?

  A. Administrative Identities

  B. Local User Intel

  C. Identities

  D. Privileged Accounts

  Correct Answer: C

• Question 90:

  An administrator is asked to configure an "Nslookup" adaptive response action, so that it appears as a selectable option in the notable event's action menu when an analyst is working in the Incident Review dashboard. What steps would the administrator take to configure this option?

  A. Configure -> Content Management -> Type: Correlation Search -> Notable -> Nslookup

  B. Configure -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

  C. Configure -> Content Management -> Type: Correlation Search -> Notable -> Next Steps -> Nslookup

  D. Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions > Nslookup

  Correct Answer: D