SPLK-3001 Exam Training Practice Tests (Splunk Enterprise Security Certified Admin)]

Question 1

Which of these is a benefit of data normalization?

A. Forwarder-based inputs are more efficient. B. Searches can be built no matter the specific source technology for a normalized data type. C. Reports run faster because normalized data models can be optimized for better performance. D. Dashboards take longer to build.

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

Where are attachments to investigations stored?

A. KV Store B. <splunk_home>/etc/apps/SA-Investigations/default/ui/views/attachments C. attachments.csv lookup D. notable index

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 3

Which of the following is part of tuning correlation searches for a new ES installation?

A. Configuring correlation result storage. B. Configuring correlation adaptive responses. C. Configuring correlation notable event index. D. Configuring correlation permissions.

Correct Answer: B

Question 4

To which of the following should the ES application be uploaded?

A. The indexer. B. The dedicated forwarder. C. The KV Store. D. The search head.

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 5

What do threat gen searches produce?

A. Events in the threat_activity index. B. Threat notables in the notable index. C. Threat correlation searches. D. Threat intel in KV Store collections.

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 6

How is notable event urgency calculated?

A. Alert severity found by the correlation search. B. Asset priority and threat weight. C. Severity set by the correlation search and priority assigned to the associated asset or identity. D. Asset or identity risk and severity found by the correlation search.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.
Which of the following options is most likely to help performance?

A. Increase memory and CPUs on the search head(s) and add additional indexers. B. Add heavy forwarders between the universal forwarders and indexers so inputs can be parsed before indexing. C. If indexed realtime search is enabled, disable it for the notable index. D. Change the search heads to do local indexing of summary searches.

Correct Answer: A

Question 8

Which correlation search feature is used to throttle the creation of notable events?

A. Schedule priority. B. Window duration. C. Window interval. D. Schedule window.

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 9

After data is ingested, which data management step is essential to ensure raw data can be accelerated by a Data Model and used by ES?

A. Normalization to the Splunk Common Information Model. B. Normalization to Customer Standard. C. Applying Tags. D. Extracting Fields.

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Splunk Enterprise Security Certified Admin - SPLK-3001 Exam Practice Test