Free SPLK-3001 Exam Dumps Preview

Question 1

Single choice

Which component normalizes events?

1. A

   SA-CIM.

2. B

   SA-Notable.

3. C

   ES application.

4. D

   Technology add-on.

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime

Question 2

Single choice

What can be exported from ES using the Content Management page?

1. A

   Only correlation searches, managed lookups, and glass tables.

2. B

   Only correlation searches.

3. C

   Any content type listed in the Content Management page.

4. D

   Only correlation searches, glass tables, and workbench panels.

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Export#:~:text=as%20an%20app-,Export%20content%20from%20Splunk%20Enterprise%20Security%20as,from%20the%20Content%20Management%20page.&text=You%20can%20export%20any%20type,%2C%20data%20models%2C%20and%20views.

Question 3

Single choice

What is the bar across the bottom of any ES window?

1. A

   The Investigator Workbench.

2. B

   The Investigation Bar.

3. C

   The Analyst Bar.

4. D

   The Compliance Bar.

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://docs.splunk.com/Documentation/ES/6.4.1/User/Startaninvestigation

Question 4

Single choice

Which indexes are searched by default for CIM data models?

1. A

   notable and default

2. B

   summary and notable

3. C

   _internal and summary

4. D

   All indexes

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://answers.splunk.com/answers/600354/indexes-searched-by-cim-data-models.html

Question 5

Single choice

Which column in the Asset or Identity list is combined with event security to make a notable event's urgency?

1. A

   VIP

2. B

   Priority

3. C

   Importance

4. D

   Criticality

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://docs.splunk.com/Documentation/ES/6.1.0/User/Howurgencyisassigned

Question 6

Single choice

An administrator wants to ensure that none of the ES indexed data could be compromised through tampering.

What feature would satisfy this requirement?

1. A

   Index consistency.

2. B

   Data integrity control.

3. C

   Indexer acknowledgement.

4. D

   Index access permissions.

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://answers.splunk.com/answers/790783/anti-tampering-features-to-protect-splunk-logs-the.html

Question 7

Single choice

Which tool Is used to update indexers In E5?

1. A

   Index Updater

2. B

   Distributed Configuration Management

3. C

   indexes.conf

4. D

   Splunk_TA_ForIndexeres. spl

Reveal answer details Close answer details

Correct answerB

Question 8

Single choice

What is the maximum recommended volume of indexing per day, per indexer, for a non-cloud (on-prem) ES deployment?

1. A

   50 GB

2. B

   100 GB

3. C

   300 GB

4. D

   500 MB

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://docs.splunk.com/Documentation/ITSI/4.4.2/Install/Plan

Question 9

Single choice

Which of the following is a recommended pre-installation step?

1. A

   Disable the default search app.

2. B

   Configure search head forwarding.

3. C

   Download the latest version of KV Store from MongoDBxom.

4. D

   Install the latest Python distribution on the search head.

Reveal answer details Close answer details

Correct answerB

Question 10

Single choice

What is the main purpose of the Dashboard Requirements Matrix document?

1. A

   Identifies on which data model(s) each dashboard depends.

2. B

   Provides instructions for customizing each dashboard for local data models.

3. C

   Identifies the searches used by the dashboards.

4. D

   Identifies which data model(s) depend on each dashboard.

Reveal answer details Close answer details

Correct answerD

Question 11

Single choice

Which columns in the Assets lookup are used to identify an asset in an event?

1. A

   src, dvc, dest

2. B

   cidr, port, netbios, saml

3. C

   ip, mac, dns, nt_host

4. D

   host, hostname, url, address

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Formatassetoridentitylist

Question 12

Single choice

The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data.

What data model should be checked for potential errors such as skipped searches?

1. A

   Web

2. B

   Risk

3. C

   Performance

4. D

   Authentication

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://answers.splunk.com/answers/565482/how-to-resolve-skipped-scheduled-searches.html

Question 13

Single choice

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.

Which of the following options is most likely to help performance?

1. A

   Change the search heads to do local indexing of summary searches.

2. B

   Add heavy forwarders between the universal forwarders and indexers so inputs can be parsed before indexing.

3. C

   Increase memory and CPUs on the search head(s) and add additional indexers.

4. D

   If indexed realtime search is enabled, disable it for the notable index.

Reveal answer details Close answer details

Correct answerC

Question 14

Single choice

What are adaptive responses triggered by?

1. A

   By correlation searches and users on the incident review dashboard.

2. B

   By correlation searches and custom tech add-ons.

3. C

   By correlation searches and users on the threat analysis dashboard.

4. D

   By custom tech add-ons and users on the risk analysis dashboard.

Reveal answer details Close answer details

Correct answerD

Question 15

Single choice

Adaptive response action history is stored in which index?

1. A

   cim_modactions

2. B

   modular_history

3. C

   cim_adaptiveactions

4. D

   modular_action_history

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://docs.splunk.com/Documentation/ES/6.1.0/Install/Indexes