A security manager has been working with the executive team en long-range security goals. A primary goal for the team Is to Improve managing user risk in the organization. Which of the following ES features can help identify users accessing inappropriate web sites?

Configuring user and website watchlists so the User Activity dashboard will highlight unwanted user actions.

Configuring the identities lookup with user details to enrich notable event Information for forensic analysis.

Make sure the Authentication data model contains up-to-date events and is properly accelerated.

Configuring user and website watchlists so the User Activity dashboard will highlight unwanted user actions.

Use the Access Anomalies dashboard to identify unusual protocols being used to access corporate sites.

How is it possible to specify an alternate location for accelerated storage?

Use the tstatsHomePath setting in props, conf

Configure storage optimization settings for the index.

Update the Home Path setting in indexes, conf

Use the tstatsHomePath setting in props, conf

Use the tstatsHomePath Setting in indexes, conf

When installing Enterprise Security, what should be done after installing the add-ons necessary for normalizing data?

Configure the add-ons according to their README or documentation.

Disable the add-ons until they are ready to be used, then enable the add-ons.

Nothing, there are no additional steps for add-ons.

Configure the add-ons via the Content Management dashboard.

What can be exported from ES using the Content Management page?

Any content type listed in the Content Management page.

Only correlation searches, managed lookups, and glass tables.

Any content type listed in the Content Management page.

Only correlation searches, glass tables, and workbench panels.

Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events.How would the admin restrict these users from being able to change the status of Resolved notable events to Closed?

From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the Closed status.

In Enterprise Security, give the ess_user role the Own Notable Events permission.

From the Status Configuration window select the Closed status. Remove ess_user from the status transitions for the Resolved status.

From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the Closed status.

From Splunk Access Controls, select the ess_user role and remove the edit_notable_events capability.

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.Which of the following options is most likely to help performance?

Increase memory and CPUs on the search head(s) and add additional indexers.

Change the search heads to do local indexing of summary searches.

Add heavy forwarders between the universal forwarders and indexers so inputs can be parsed before indexing.

Increase memory and CPUs on the search head(s) and add additional indexers.

If indexed realtime search is enabled, disable it for the notable index.

A set of correlation searches are enabled at a new ES installation, and results are being monitored.One of the correlation searches is generating many notable events which, when evaluated, are determined to be false positives.What is a solution for this issue?

Suppress notable events from that correlation search.

Disable acceleration for the correlation search to reduce storage requirements.

Modify the correlation schedule and sensitivity for your site.

Change the correlation search's default status and severity.

Where is detailed information about identities stored?

The Identity Investigator index.

The Access Anomalies collection.

What does the summariesonly=true option do for a correlation search?

Searches only accelerated data.

Forwards summary indexes to the indexing tier.

Uses a default summary time range.

What is the main purpose of the Dashboard Requirements Matrix document?

Identifies which data model(s) depend on each dashboard.

Identifies on which data model(s) each dashboard depends.

Provides instructions for customizing each dashboard for local data models.

Identifies the searches used by the dashboards.

Identifies which data model(s) depend on each dashboard.

What are adaptive responses triggered by?

By custom tech add-ons and users on the risk analysis dashboard.

By correlation searches and users on the incident review dashboard.

By correlation searches and custom tech add-ons.

By correlation searches and users on the threat analysis dashboard.

By custom tech add-ons and users on the risk analysis dashboard.

How does ES know local customer domain names so it can detect internal vs. external emails?

The Corporate Web and Email Domain Lookups are edited during initial configuration.

Web and email domain names are set in General -> General Configuration.

ES uses the User Activity index and applies machine learning to determine internal and external domains.

The Corporate Web and Email Domain Lookups are edited during initial configuration.

ES extracts local email and web domains automatically from SMTP and HTTP logs.

After data is ingested, which data management step is essential to ensure raw data can be accelerated by a Data Model and used by ES?

Normalization to the Splunk Common Information Model.

Normalization to Customer Standard.

Normalization to the Splunk Common Information Model.

Splunk SPLK-3001 Practice Test 3 - Free Online Exam Prep & Questions

Which of the following is part of tuning correlation searches for a new ES installation?

Become a Premium Member for full access

Unlock Premium Member

Splunk SPLK-3001 Practice Test 3

Question

Splunk SPLK-3001 Practice Tests

Practice Tests