Which of the following are examples of sources for events in the endpoint security domain dashboards?

Workstations, notebooks, and point-of-sale systems.

Investigation final results status.

Workstations, notebooks, and point-of-sale systems.

Lifecycle auditing of incidents, from assignment to resolution.

What feature of Enterprise Security downloads threat intelligence data from a web server?

Therat Intelligence Enforcement

Which of the following is a way to test for a property normalized data model?

Run a | datamodel search, compare results to the CIM documentation for the datamodel.

Use Audit -> Normalization Audit and check the Errors panel.

Run a | datamodel search, compare results to the CIM documentation for the datamodel.

Run a | loadjob search, look at tag values and compare them to known tags based on the encoding.

Run a | datamodel search and compare the results to the list of data models in the ES normalization guide.

When investigating, what is the best way to store a newly-found IOC?

Click the “Add Artifact” button.

Click the “Add IOC” button.

Click the “Add Artifact” button.

Add it in a text note to the investigation.

How is it possible to navigate to the list of currently-enabled ES correlation searches?

Configure -> Content Management -> Select Type “Correlation” and Status “Enabled”

Configure -> Correlation Searches -> Select Status “Enabled”

Settings -> Searches, Reports, and Alerts -> Filter by Name of “Correlation”

Configure -> Content Management -> Select Type “Correlation” and Status “Enabled”

Settings -> Searches, Reports, and Alerts -> Select App of “SplunkEnterpriseSecuritySuite” and filter by “- Rule”

Which of the following is a risk of using the Auto Deployment feature of Distributed Configuration Management to distribute indexes.conf?

Indexes might not be reachable.

Indexes have different settings.

At what point in the ES installation process should Splunk_TA_ForIndexes.spl be deployed to the indexers?

After installing ES on the search head(s) and running the distributed configuration management tool.

When adding apps to the deployment server.

Splunk_TA_ForIndexers.spl is installed first.

After installing ES on the search head(s) and running the distributed configuration management tool.

Splunk_TA_ForIndexers.spl is only installed on indexer cluster sites using the cluster master and the splunk apply cluster-bundle command.

Both “Recommended Actions” and “Adaptive Response Actions” use adaptive response. How do they differ?

Recommended Actions show a list of Adaptive Resposes to an analyst, Adaptive Response Actions run manually with analyst intervention.

Recommended Actions show a textual description to an analyst, Adaptive Response Actions show them encoded.

Recommended Actions show a list of Adaptive Responses to an analyst, Adaptive Response Actions run them automatically.

Recommended Actions show a list of Adaptive Responses that have already been run, Adaptive Response Actions run them automatically.

Recommended Actions show a list of Adaptive Resposes to an analyst, Adaptive Response Actions run manually with analyst intervention.

What does the Security Posture dashboard display?

A high-level overview of notable events.

Active investigations and their status.

A high-level overview of notable events.

Current threats being tracked by the SOC.

A display of the status of security tools.

How should an administrator add a new lookup through the ES app?

Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup

Upload the lookup file in Settings -> Lookups -> Lookup Definitions

Upload the lookup file in Settings -> Lookups -> Lookup table files

Add the lookup file to /etc/apps/SplunkEnterpriseSecuritySuite/lookups

Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup

Which of the following is a key feature of a glass table?

Strong data for later retrieval.

An administrator is asked to configure an “Nslookup” adaptive response action, so that it appears as a selectable option in the notable event’s action menu when an analyst is working in the Incident Review dashboard. What steps would the administrator take to configure this option?

Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

Configure -> Content Management -> Type: Correlation Search -> Notable -> Nslookup

Configure -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

Configure -> Content Management -> Type: Correlation Search -> Notable -> Next Steps -> Nslookup

Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

Configure -> Incident Management -> Incident Review Settings -> Table Attributes

Configure -> Incident Management -> Notable Event Statuses

Configure -> Content Management -> Type: Correlation Search

Configure -> Incident Management -> Incident Review Settings -> Event Management

Configure -> Incident Management -> Incident Review Settings -> Table Attributes

Which of the following actions would not reduce the number of false positives from a correlation search?

Increasing the throttling window.

Increasing threshold sensitivity.

ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

$SPLUNK_HOME/etc/shcluster/apps

$SPLUNK_HOME/var/run/searchpeers/

How is notable event urgency calculated?

Severity set by the correlation search and priority assigned to the associated asset or identity.

Asset priority and threat weight.

Alert severity found by the correlation search.

Asset or identity risk and severity found by the correlation search.

Severity set by the correlation search and priority assigned to the associated asset or identity.

Where is it possible to export content, such as correlation searches, from ES?

Configure -> Content Management

Which of the following threat intelligence types can ES download? (Choose all that apply)

SplunkEnterpriseThreatGenerator

A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?

Add a new search head and install ES on it.

Install ES on the existing search head.

Add a new search head and install ES on it.

Increase the number of CPUs and amount of memory on the search head, then install ES.

Delete the non-CIM-compliant apps from the search head, then install ES.

Splunk SPLK-3001 Practice Test 1 - Free Online Exam Prep & Questions

The Add-On Builder creates Splunk Apps that start with what?

App-

Comment (0)

Splunk SPLK-3001 Practice Test 1

Question

Splunk SPLK-3001 Practice Tests

Practice Tests