SPLK-3001 Practice Test Questions – Splunk Enterprise Security Certified Admin

1. The Add-On Builder creates Splunk Apps that start with what?

2. Which of the following are examples of sources for events in the endpoint security domain dashboards?

3. When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

4. What feature of Enterprise Security downloads threat intelligence data from a web server?

5. The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data.

What data model should be checked for potential errors such as skipped searches?

6. In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?

7. What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?

8. Which column in the Asset or Identity list is combined with event security to make a notable event’s urgency?

9. What does the risk framework add to an object (user, server or other type) to indicate increased risk?

10. Which indexes are searched by default for CIM data models?

11. The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data.

What data model should be checked for potential errors such as skipped searches?

12. Which of the following actions can improve overall search performance?

13. Which feature contains scenarios that are useful during ES Implementation?

14. Following the Installation of ES, an admin configured Leers with the ©ss_uso r role the ability to close notable events.

How would the admin restrict these users from being able to change the status of Resolved notable events to closed?

15. How is it possible to navigate to the list of currently-enabled ES correlation searches?

16. What is the first step when preparing to install ES?

17. Which of the following would allow an add-on to be automatically imported into Splunk Enterprise Security?

18. Where is it possible to export content, such as correlation searches, from ES?

19. “10.22.63.159”, “websvr4”, and “00:26:08:18: CF:1D” would be matched against what in ES?

20. A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance.

What is the best practice for installing ES?

21. Where is the Add-On Builder available from?

22. Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

23. Adaptive response action history is stored in which index?

24. Which of the following is a risk of using the Auto Deployment feature of Distributed Configuration Management to distribute indexes.conf?

25. If a username does not match the ‘identity’ column in the identities list, which column is checked next?

26. What is the bar across the bottom of any ES window?

27. After managing source types and extracting fields, which key step comes next In the Add-On Builder?

28. Which argument to the | tstats command restricts the search to summarized data only?

29. Where should an ES search head be installed?

30. When investigating, what is the best way to store a newly-found IOC?

31. Which of the following threat intelligence types can ES download? (Choose all that apply)

32. Which correlation search feature is used to throttle the creation of notable events?

33. At what point in the ES installation process should Splunk_TA_ForIndexes.spl be deployed to the indexers?

34. Which of the following features can the Add-on Builder configure in a new add-on?

35. Analysts have requested the ability to capture and analyze network traffic data. The administrator has researched the documentation and, based on this research, has decided to integrate the Splunk App for Stream with ES.

Which dashboards will now be supported so analysts can view and analyze network Stream data?