Vendor | : | Splunk |
Exam Code | : | SPLK-3001 |
Exam Name | : | Splunk Enterprise Security Certified Admin |
Questions and Answers | : | 60 Q & A |
Updated On | : | Click to Check Update |
PDF Download Mirror | : | SPLK-3001 Brain Dump |
Get Full Version | : | Pass4sure SPLK-3001 Full Version |
Question: 52
Which indexes are searched by default for CIM data models?
Answer: D
Reference: https://answers.splunk.com/answers/600354/indexes-searched-by-cim-data-models.html
Question: 53
What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?
Answer: B
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Triagenotableevents
Question: 54
Which column in the Asset or Identity list is combined with event security to make a notable event’s urgency?
Answer: B
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Howurgencyisassigned
Question: 55
The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data. What data model should be checked for potential errors such as skipped searches?
Answer: A
Reference: https://answers.splunk.com/answers/565482/how-to-resolve-skipped-scheduled-searches.html
Question: 56
In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?
Answer: C
Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizeOSSECdata
Question: 57
When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?
Answer: C
Reference: https://docs.splunk.com/Documentation/ITSI/4.4.2/Configure/Createcorrelationsearch
Question: 58
What feature of Enterprise Security downloads threat intelligence data from a web server?
Answer: B
Question: 59
Which of the following are examples of sources for events in the endpoint security domain dashboards?
Answer: D
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/EndpointProtectionDomaindashboards
Question: 60
The Add-On Builder creates Splunk Apps that start with what?
Answer: C
Reference: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/abouttheessolution/