ES needs to be installed on a search head with which of the following options?

Only default built-in and CIM-compliant apps.

All apps removed except for TA-*.

Only default built-in and CIM-compliant apps.

Where are attachments to investigations stored?

<splunk_home>/etc/apps/SA-Investigations/default/ui/views/attachments

How is it possible to navigate to the ES graphical Navigation Bar editor?

Configure -> General -> Navigation

Settings -> User Interface -> Navigation -> Click on “Enterprise Security”

Settings -> User Interface -> Navigation Menus -> Click on “default” next to SplunkEnterpriseSecuritySuite

An administrator is provisioning one search head prior to installing ES. What are the reference minimum requirements for OS, CPU, and RAM for that machine?

OS: 64 bit, RAM: 12 MB, CPU: 16 cores

OS: 32 bit, RAM: 16 MB, CPU: 12 cores

OS: 64 bit, RAM: 32 MB, CPU: 12 cores

OS: 64 bit, RAM: 12 MB, CPU: 16 cores

OS: 64 bit, RAM: 32 MB, CPU: 16 cores

What tools does the Risk Analysis dashboard provide?

A display of the highest risk assets and identities.

Notable event domains displayed by risk score.

A display of the highest risk assets and identities.

Key indicators showing the highest probability correlation searches in the environment.

When ES content is exported, an app with a .spl extension is automatically created. What is the best practice when exporting and importing updates to ES content?

Either use new app names or always include both existing and new content.

Use new app names each time content is exported.

Do not use the .spl extension when naming an export.

Always include existing and new content for each export.

Either use new app names or always include both existing and new content.

Who can delete an investigation?

The investigation owner and ess-admin.

The investigation owner and collaborators.

The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated. How can the correlation search be made less sensitive?

Edit the search, look for where or xswhere statements, and after the threshold value being compared to make it less common match.

Edit the search and modify the notable event status field to make the notable events less urgent.

Edit the search, look for where or xswhere statements, and after the threshold value being compared to make it less common match.

Edit the search, look for where or xswhere statements, and alter the threshold value being compared to make it a more common match.

Modify the urgency table for this correlation search and add a new severity level to make notable events from this search less urgent.

Which of the following actions can improve overall search performance?

Disable indexed real-time search.

Increase priority of all correlation searches.

Reduce the frequency (schedule) of lower-priority correlation searches.

Add notable event suppressions for correlation searches with high numbers of false positives.

Which of the following ES features would a security analyst use while investigating a network anomaly notable?

Protocol intelligence dashboard.

What is the first step when preparing to install ES?

Determine the size and scope of installation.

Determine the data sources used.

Determine the hardware required.

Determine the size and scope of installation.

Which of the following is a Web Intelligence dashboard?

stream :http Protocol dashboard

Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

SplunkWeb (8000), Splunk Management (8089), KV Store (8191)

SplunkWeb (8068), Splunk Management (8089), KV Store (8000)

SplunkWeb (8390), Splunk Management (8323), KV Store (8672)

SplunkWeb (8000), Splunk Management (8089), KV Store (8191)

SplunkWeb (8043), Splunk Management (8088), KV Store (8191)

Which tool Is used to update indexers In E5?

Distributed Configuration Management

Which of the following actions may be necessary before installing ES?

Redirect distributed search connections.

When using distributed configuration management to create the Splunk_TA_ForIndexers package, which three files can be included?

indexes.conf, props.conf, transforms.conf

web.conf, props.conf, transforms.conf

inputs.conf, props.conf, transforms.conf

eventtypes.conf, indexes.conf, tags.conf

Which of these Is a benefit of data normalization?

Reports run faster because normalized data models can be optimized for better performance.

Dashboards take longer to build.

Searches can be built no matter the specific source technology for a normalized data type.

Forwarder-based inputs are more efficient.

Following the Installation of ES, an admin configured Leers with the ©ss_uso r role the ability to close notable events. How would the admin restrict these users from being able to change the status of Resolved notable events to closed?

From the Status Configuration windows select the closed status. Remove ess_use r from the status transitions for the Resolved status.

From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the closed status.

From the Status Configuration windows select the closed status. Remove ess_use r from the status transitions for the Resolved status.

In Enterprise Security, give the ess_user role the own Notable Events permission.

From Splunk Access Controls, select the ess_user role and remove the edit_notabie_events capability.

Where should an ES search head be installed?

On a Splunk server with top level visibility.

On a server with a new install of Splunk.

On a Splunk server running Splunk DB Connect.

A newly built custom dashboard needs to be available to a team of security analysts In ES. How is It possible to Integrate the new dashboard?

Set the dashboard permissions to allow access by es_analysts and use the navigation editor to add it to the menu.

Add links on the ES home page to the new dashboard.

Create a new role Inherited from es_analyst, make the dashboard permissions read-only, and make this dashboard the default view for the new role.

Set the dashboard permissions to allow access by es_analysts and use the navigation editor to add it to the menu.

Add the dashboard to a custom add-in app and install it to ES using the Content Manager.

Analysts have requested the ability to capture and analyze network traffic dat a. The administrator has researched the documentation and, based on this research, has decided to integrate the Splunk App for Stream with ES.Which dashboards will now be supported so analysts can view and analyze network Stream data?

Protocol Intelligence dashboards.

Which of the following is a recommended pre-installation step?

Configure search head forwarding.

Disable the default search app.

Configure search head forwarding.

Download the latest version of KV Store from MongoDBxom.

Install the latest Python distribution on the search head.

Which of the following steps will make the Threat Activity dashboard the default landing page in ES?

From the Edit Navigation page, click the 'Set this as the default view" checkmark for Threat Activity.

From the Edit Navigation page, drag and drop the Threat Activity view to the top of the page.

From the Preferences menu for the user, select Enterprise Security as the default application.

From the Edit Navigation page, click the 'Set this as the default view" checkmark for Threat Activity.

Edit the Threat Activity view settings and checkmark the Default View option.

What do threat gen searches produce?

Events in the threat_activity index.

Threat Intel in KV Store collections.

Threat notables in the notable index.

Events in the threat_activity index.

Splunk SPLK-3001 Practice Test 2 - Free Online Exam Prep & Questions

If a username does not match the ‘identity’ column in the identities list, which column is checked next?

Email.

Nickname

IP address.

Combination of Last Name, First Name.

Comment (0)

Splunk SPLK-3001 Practice Test 2

Question

Splunk SPLK-3001 Practice Tests

Practice Tests