Home / Splunk / SPLK-3001

Splunk SPLK-3001 Practice Test - Questions Answers, Page 9

Question list

List of questions

Question 81

(0)

Which of the following is part of tuning correlation searches for a new ES installation?

Question 82

(0)

A security manager has been working with the executive team en long-range security goals. A primary goal for the team Is to Improve managing user risk in the organization. Which of the following ES

Question 83

(0)

How is it possible to specify an alternate location for accelerated storage?

Question 84

(0)

When installing Enterprise Security, what should be done after installing the add-ons necessary for normalizing data?

Question 85

(0)

Accelerated data requires approximately how many times the daily data volume of additional storage space per year?

Question 86

(0)

What can be exported from ES using the Content Management page?

Question 87

(0)

Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events. How would the admin restrict these users from being able to change the status

Question 88

(0)

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicat

Question 89

(0)

What should be used to map a non-standard field name to a CIM field name?

Question 90

(0)

Which of the following lookup types in Enterprise Security contains information about known hostile IP addresses?

Question 81

Which of the following is part of tuning correlation searches for a new ES installation?

Configuring correlation notable event index.

Configuring correlation permissions.

Configuring correlation adaptive responses.

Configuring correlation result storage.

Show Answer Comment (0)

A security manager has been working with the executive team en long-range security goals. A primary goal for the team Is to Improve managing user risk in the organization. Which of the following ES features can help identify users accessing inappropriate web sites?

Configuring the identities lookup with user details to enrich notable event Information for forensic analysis.

Make sure the Authentication data model contains up-to-date events and is properly accelerated.

Configuring user and website watchlists so the User Activity dashboard will highlight unwanted user actions.

Use the Access Anomalies dashboard to identify unusual protocols being used to access corporate sites.

Show Answer Comment (0)

Question 83

How is it possible to specify an alternate location for accelerated storage?

Configure storage optimization settings for the index.

Update the Home Path setting in indexes, conf

Use the tstatsHomePath setting in props, conf

Use the tstatsHomePath Setting in indexes, conf

Show Answer Comment (0)

Question 84

When installing Enterprise Security, what should be done after installing the add-ons necessary for normalizing data?

Configure the add-ons according to their README or documentation.

Disable the add-ons until they are ready to be used, then enable the add-ons.

Nothing, there are no additional steps for add-ons.

Configure the add-ons via the Content Management dashboard.

Show Answer Comment (0)

Question 85

Accelerated data requires approximately how many times the daily data volume of additional storage space per year?

3.4

5.7

1.0

2.5

Show Answer Comment (0)

Question 86

What can be exported from ES using the Content Management page?

Only correlation searches, managed lookups, and glass tables.

Only correlation searches.

Any content type listed in the Content Management page.

Only correlation searches, glass tables, and workbench panels.

Show Answer Comment (0)

Question 87

Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events.

How would the admin restrict these users from being able to change the status of Resolved notable events to Closed?

In Enterprise Security, give the ess_user role the Own Notable Events permission.

From the Status Configuration window select the Closed status. Remove ess_user from the status transitions for the Resolved status.

From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the Closed status.

From Splunk Access Controls, select the ess_user role and remove the edit_notable_events capability.

Show Answer Comment (0)

Question 88

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.

Which of the following options is most likely to help performance?

Change the search heads to do local indexing of summary searches.

Add heavy forwarders between the universal forwarders and indexers so inputs can be parsed before indexing.

Increase memory and CPUs on the search head(s) and add additional indexers.

If indexed realtime search is enabled, disable it for the notable index.

Show Answer Comment (0)