Home / Splunk / SPLK-3001

Splunk SPLK-3001 Practice Test - Questions Answers, Page 6

Question list

List of questions

Question 51

(0)

When ES content is exported, an app with a .spl extension is automatically created. What is the best practice when exporting and importing updates to ES content?

Question 52

(0)

Who can delete an investigation?

Question 53

(0)

After installing Enterprise Security, the distributed configuration management tool can be used to create which app to configure indexers?

Question 54

(0)

The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated. How can the correlation search be

Question 55

(0)

Which of the following actions can improve overall search performance?

Question 56

(0)

Which of the following ES features would a security analyst use while investigating a network anomaly notable?

Question 57

(0)

Which component normalizes events?

Question 58

(0)

An administrator wants to ensure that none of the ES indexed data could be compromised through tampering. What feature would satisfy this requirement?

Question 59

(0)

What is the first step when preparing to install ES?

Question 60

(0)

What is the default schedule for accelerating ES Datamodels?

Question 51

When ES content is exported, an app with a .spl extension is automatically created. What is the best practice when exporting and importing updates to ES content?

Use new app names each time content is exported.

Do not use the .spl extension when naming an export.

Always include existing and new content for each export.

Either use new app names or always include both existing and new content.

Show Answer Comment (0)

Question 52

Who can delete an investigation?

ess_admin users only.

The investigation owner only.

The investigation owner and ess-admin.

The investigation owner and collaborators.

Show Answer Comment (0)

Question 53

After installing Enterprise Security, the distributed configuration management tool can be used to create which app to configure indexers?

Splunk_DS_ForIndexers.spl

Splunk_ES_ForIndexers.spl

Splunk_SA_ForIndexers.spl

Splunk_TA_ForIndexers.spl

Show Answer Comment (0)

The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated. How can the correlation search be made less sensitive?

Edit the search and modify the notable event status field to make the notable events less urgent.

Edit the search, look for where or xswhere statements, and after the threshold value being compared to make it less common match.

Edit the search, look for where or xswhere statements, and alter the threshold value being compared to make it a more common match.

Modify the urgency table for this correlation search and add a new severity level to make notable events from this search less urgent.

Show Answer Comment (0)

Question 55

Which of the following actions can improve overall search performance?

Disable indexed real-time search.

Increase priority of all correlation searches.

Reduce the frequency (schedule) of lower-priority correlation searches.

Add notable event suppressions for correlation searches with high numbers of false positives.

Show Answer Comment (0)

Question 56

Which of the following ES features would a security analyst use while investigating a network anomaly notable?

Correlation editor.

Key indicator search.

Threat download dashboard.

Protocol intelligence dashboard.

Show Answer Comment (0)

Question 57

Which component normalizes events?

SA-CIM.

SA-Notable.

ES application.

Technology add-on.

Show Answer Comment (0)

Question 58

An administrator wants to ensure that none of the ES indexed data could be compromised through tampering. What feature would satisfy this requirement?

Index consistency.

Data integrity control.

Indexer acknowledgement.

Index access permissions.

Show Answer Comment (0)