Home / Splunk / SPLK-3001

Splunk SPLK-3001 Practice Test - Questions Answers, Page 4

Question list

List of questions

Question 31

(0)

Where is the Add-On Builder available from?

Question 32

(0)

Which of the following would allow an add-on to be automatically imported into Splunk Enterprise Security?

Question 33

(0)

ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

Question 34

(0)

How is notable event urgency calculated?

Question 35

(0)

What kind of value is in the red box in this picture?

Question 36

(0)

Where is it possible to export content, such as correlation searches, from ES?

Question 37

(0)

Which of the following threat intelligence types can ES download? (Choose all that apply)

Question 38

(0)

A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost,

Question 39

(0)

Enterprise Security’s dashboards primarily pull data from what type of knowledge object?

Question 40

(0)

To which of the following should the ES application be uploaded?

Question 31

Where is the Add-On Builder available from?

GitHub

SplunkBase

www.splunk.com

The ES installation package

Show Answer Comment (0)

Question 32

Which of the following would allow an add-on to be automatically imported into Splunk Enterprise Security?

A prefix of CIM_

A suffix of .spl

A prefix of TECH_

A prefix of Splunk_TA_

Show Answer Comment (0)

Question 33

ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

$SPLUNK_HOME/etc/master-apps/

$SPLUNK_HOME/etc/system/local/

$SPLUNK_HOME/etc/shcluster/apps

$SPLUNK_HOME/var/run/searchpeers/

Show Answer Comment (0)

Question 34

How is notable event urgency calculated?

Asset priority and threat weight.

Alert severity found by the correlation search.

Asset or identity risk and severity found by the correlation search.

Severity set by the correlation search and priority assigned to the associated asset or identity.

Show Answer Comment (0)

Question 35

What kind of value is in the red box in this picture?

A risk score.

A source ranking.

An event priority.

An IP address rating.

Show Answer Comment (0)

Question 36

Where is it possible to export content, such as correlation searches, from ES?

Content exporter

Configure -> Content Management

Export content dashboard

Settings Menu -> ES -> Export

Show Answer Comment (0)

Question 37

Which of the following threat intelligence types can ES download? (Choose all that apply)

Text

STIX/TAXII

VulnScanSPL

SplunkEnterpriseThreatGenerator

Show Answer Comment (0)

A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?

Install ES on the existing search head.

Add a new search head and install ES on it.

Increase the number of CPUs and amount of memory on the search head, then install ES.

Delete the non-CIM-compliant apps from the search head, then install ES.

Show Answer Comment (0)