How Many Questions Of SPLK-3001 Questions Pool

NEW QUESTION 1
What does the Security Posture dashboard display?

• A. Active investigations and their status.
• B. A high-level overview of notable events.
• C. Current threats being tracked by the SOC.
• D. A display of the status of security tools.

Answer: B

Explanation:
The Security Posture dashboard is designed to provide high-level insight into the notable events across all domains of your deployment, suitable for display in a Security Operations Center (SOC). This dashboard shows all events from the past 24 hours, along with the trends over the past 24 hours, and provides real-time event information and updates.
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/SecurityPosturedashboard

NEW QUESTION 2
Which argument to the | tstats command restricts the search to summarized data only?

• A. summaries=t
• B. summaries=all
• C. summariesonly=t
• D. summariesonly=all

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Acceleratedatamodels

NEW QUESTION 3
To which of the following should the ES application be uploaded?

• A. The indexer.
• B. The KV Store.
• C. The search head.
• D. The dedicated forwarder.

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Install/InstallEnterpriseSecuritySHC

NEW QUESTION 4
An administrator is provisioning one search head prior to installing ES. What are the reference minimum requirements for OS, CPU, and RAM for that machine?

• A. OS: 32 bit, RAM: 16 MB, CPU: 12 cores
• B. OS: 64 bit, RAM: 32 MB, CPU: 12 cores
• C. OS: 64 bit, RAM: 12 MB, CPU: 16 cores
• D. OS: 64 bit, RAM: 32 MB, CPU: 16 cores

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Capacity/Referencehardware

NEW QUESTION 5
Which of the following actions would not reduce the number of false positives from a correlation search?

• A. Reducing the severity.
• B. Removing throttling fields.
• C. Increasing the throttling window.
• D. Increasing threshold sensitivity.

Answer: A

NEW QUESTION 6
Which correlation search feature is used to throttle the creation of notable events?

• A. Schedule priority.
• B. Window interval.
• C. Window duration.
• D. Schedule windows.

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Configurecorrelationsearches

NEW QUESTION 7
Which of the following are examples of sources for events in the endpoint security domain dashboards?

• A. REST API invocations.
• B. Investigation final results status.
• C. Workstations, notebooks, and point-of-sale systems.
• D. Lifecycle auditing of incidents, from assignment to resolution.

Answer: D

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/EndpointProtectionDomaindashboards

NEW QUESTION 8
Which settings indicated that the correlation search will be executed as new events are indexed?

• A. Always-On
• B. Real-Time
• C. Scheduled
• D. Continuous

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Configurecorrelationsearches

NEW QUESTION 9
Which of the following threat intelligence types can ES download? (Choose all that apply)

• A. Text
• B. STIX/TAXII
• C. VulnScanSPL
• D. SplunkEnterpriseThreatGenerator

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Downloadthreatfeed

NEW QUESTION 10
To observe what network services are in use in a network’s activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?

• A. Intrusion Center
• B. Protocol Analysis
• C. User Intelligence
• D. Threat Intelligence

Answer: A

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/NetworkProtectionDomaindashboards

NEW QUESTION 11
In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?

• A. Save the settings.
• B. Apply the correct tags.
• C. Run the correct search.
• D. Visit the CIM dashboard.

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizeOSSECdata

NEW QUESTION 12
Where is the Add-On Builder available from?

• A. GitHub
• B. SplunkBase
• C. www.splunk.com
• D. The ES installation package

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/AddonBuilder/3.0.1/UserGuide/Installation

NEW QUESTION 13
How should an administrator add a new lookup through the ES app?

• A. Upload the lookup file in Settings -> Lookups -> Lookup Definitions
• B. Upload the lookup file in Settings -> Lookups -> Lookup table files
• C. Add the lookup file to /etc/apps/SplunkEnterpriseSecuritySuite/lookups
• D. Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup

Answer: D

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Createlookups

NEW QUESTION 14
The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data. What data model should be checked for potential errors such as skipped searches?

• A. Web
• B. Risk
• C. Performance
• D. Authentication

Answer: A

Explanation:
Reference: https://answers.splunk.com/answers/565482/how-to-resolve-skipped-scheduled-searches.html

NEW QUESTION 15
Which of the following is a key feature of a glass table?

• A. Rigidity.
• B. Customization.
• C. Interactive investigations.
• D. Strong data for later retrieval.

Answer: B

NEW QUESTION 16
Where are attachments to investigations stored?

• A. KV Store
• B. notable index
• C. attachments.csv lookup
• D. <splunk_home>/etc/apps/SA-Investigations/default/ui/views/attachments

Answer: A

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Manageinvestigations

NEW QUESTION 17
What tools does the Risk Analysis dashboard provide?

• A. High risk threats.
• B. Notable event domains displayed by risk score.
• C. A display of the highest risk assets and identities.
• D. Key indicators showing the highest probability correlation searches in the environment.

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/RiskAnalysis

NEW QUESTION 18
Which component normalizes events?

• A. SA-CIM.
• B. SA-Notable.
• C. ES application.
• D. Technology add-on.

Answer: A

Explanation:
Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime

NEW QUESTION 19
When ES content is exported, an app with a .spl extension is automatically created. What is the best practice when exporting and importing updates to ES content?

• A. Use new app names each time content is exported.
• B. Do not use the .spl extension when naming an export.
• C. Always include existing and new content for each export.
• D. Either use new app names or always include both existing and new content.

Answer: A

NEW QUESTION 20
A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?

• A. Install ES on the existing search head.
• B. Add a new search head and install ES on it.
• C. Increase the number of CPUs and amount of memory on the search head, then install ES.
• D. Delete the non-CIM-compliant apps from the search head, then install ES.

Answer: B

Explanation:
Reference: https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf

NEW QUESTION 21
......