SPLK-3001 Exam Questions

What does the summariesonly=true option do for a correlation search?

Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

What is the main purpose of the Dashboard Requirements Matrix document?

Which of the following is a recommended pre-installation step?

What are adaptive responses triggered by?

Which of the following is an adaptive action that is configured by default for ES?

Analysts have requested the ability to capture and analyze network traffic data. The administrator has researched the documentation and, based on this research, has decided to inte...

When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

Which lookup table does the Default Account Activity Detected correlation search use to flag known default accounts?

Which tool is used to update indexers in ES?

How is it possible to specify an alternate location for accelerated storage?

After managing source types and extracting fields, which key step comes next in the Add-On Builder?

How does ES know local customer domain names so it can detect internal vs. external emails?

Which of these is a benefit of data normalization?

A security manager has been working with the executive team on long-range security goals. A primary goal for the team is to improve managing user risk in the organization. Which of...

Which of the following is a Web Intelligence dashboard?

After data is ingested, which data management step is essential to ensure raw data can be accelerated by a Data Model and used by ES?

Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

What is an example of an ES asset?

The Add-On Builder creates Splunk Apps that start with what?

Which of the following are examples of sources for events in the endpoint security domain dashboards?

When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

What feature of Enterprise Security downloads threat intelligence data from a web server?

The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data. What data model should be checked for potential errors such as skipp...

In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?

What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?

Which column in the Asset or Identity list is combined with event security to make a notable event's urgency?

What does the risk framework add to an object (user, server or other type) to indicate increased risk?

Which indexes are searched by default for CIM data models?

Which setting is used in indexes.conf to specify alternate locations for accelerated storage?

Which of the following is a way to test for a property normalized data model?

Which argument to the | tstats command restricts the search to summarized data only?

When investigating, what is the best way to store a newly-found IOC?

What should be used to map a non-standard field name to a CIM field name?

Which of the following lookup types in Enterprise Security contains information about known hostile IP addresses?

A set of correlation searches are enabled at a new ES installation, and results are being monitored. One of the correlation searches is generating many notable events which, when e...

Which of the following steps will make the Threat Activity dashboard the default landing page in ES?

When using distributed configuration management to create the Splunk_TA_ForIndexers package, which three files can be included?

Which feature contains scenarios that are useful during ES implementation?

Where is detailed information about identities stored?

The option to create a Short ID for a notable event is located where?

A newly built custom dashboard needs to be available to a team of security analysts in ES. How is it possible to integrate the new dashboard?

How is it possible to navigate to the list of currently-enabled ES correlation searches?

Which of the following is a risk of using the Auto Deployment feature of Distributed Configuration Management to distribute indexes.conf?

Which of the following are data models used by ES? (Choose all that apply.)

At what point in the ES installation process should Splunk_TA_ForIndexers.spl be deployed to the indexers?

Which correlation search feature is used to throttle the creation of notable events?

Both 'Recommended Actions' and 'Adaptive Response Actions' use adaptive response. How do they differ?

What does the Security Posture dashboard display?

'10.22.63.159', 'websvr4', and '00:26:08:18: CF:1D' would be matched against what in ES?