SPLK-3001 Exam Questions

How should an administrator add a new lookup through the ES app?

Glass tables can display static images and text, the results of ad-hoc searches, and which of the following objects?

Which of the following is a key feature of a glass table?

An administrator is asked to configure an 'Nslookup' adaptive response action, so that it appears as a selectable option in the notable event's action menu when an analyst is worki...

What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

To observe what network services are in use in a network's activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?

Adaptive response action history is stored in which index?

Which of the following actions would not reduce the number of false positives from a correlation search?

Where is the Add-On Builder available from?

Which of the following would allow an add-on to be automatically imported into Splunk Enterprise Security?

ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

How is notable event urgency calculated?

What kind of value is in the red box in this picture?

Where is it possible to export content, such as correlation searches, from ES?

Which of the following threat intelligence types can ES download? (Choose all that apply.)

A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to caref...

Enterprise Security's dashboards primarily pull data from what type of knowledge object?

To which of the following should the ES application be uploaded?

If a username does not match the 'identity' column in the identities list, which column is checked next?

Which of the following features can the Add-on Builder configure in a new add-on?

What is the maximum recommended volume of indexing per day, per indexer, for a non-cloud (on-prem) ES deployment?

ES needs to be installed on a search head with which of the following options?

Which settings indicates that the correlation search will be executed as new events are indexed?

Where are attachments to investigations stored?

Which data model populates the panels on the Risk Analysis dashboard?

How is it possible to navigate to the ES graphical Navigation Bar editor?

An administrator is provisioning one search head prior to installing ES. What are the reference minimum requirements for OS, CPU, and RAM for that machine?

What tools does the Risk Analysis dashboard provide?

When ES content is exported, an app with a .spl extension is automatically created. What is the best practice when exporting and importing updates to ES content?

Who can delete an investigation?

After installing Enterprise Security, the distributed configuration management tool can be used to create which app to configure indexers?

The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated. How can the corr...

Which of the following actions can improve overall search performance?

Which of the following ES features would a security analyst use while investigating a network anomaly notable?

Which component normalizes events?

An administrator wants to ensure that none of the ES indexed data could be compromised through tampering. What feature would satisfy this requirement?

What is the first step when preparing to install ES?

What is the default schedule for accelerating ES Datamodels?

Accelerated data requires approximately how many times the daily data volume of additional storage space per year?

When installing Enterprise Security, what should be done after installing the add-ons necessary for normalizing data?

What can be exported from ES using the Content Management page?

Where should an ES search head be installed?

Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events. How would the admin restrict these users from being able to...

Which of the following actions may be necessary before installing ES?

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the sched...

What is the bar across the bottom of any ES window?

Which two fields combine to create the Urgency of a notable event?

What do threat gen searches produce?

Which of the following is part of tuning correlation searches for a new ES installation?

Which columns in the Assets lookup are used to identify an asset in an event?