Splunk Splunk Enterprise Security Certified Admin SPLK-3001 Questions & Answers

• Question 1:

  To which of the following should the ES application be uploaded?

  A. The indexer.

  B. The KV Store.

  C. The search head.

  D. The dedicated forwarder.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Install/InstallEnterpriseSecuritySHC

• Question 2:

  Which of the following is a key feature of a glass table?

  A. Rigidity.

  B. Customization.

  C. Interactive investigations.

  D. Strong data for later retrieval.

  Correct Answer: B

• Question 3:

  Which of the following threat intelligence types can ES download? (Choose all that apply)

  A. Text

  B. STIX/TAXII

  C. VulnScanSPL

  D. SplunkEnterpriseThreatGenerator

  Correct Answer: AB

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Downloadthreatfeed

• Question 4:

  When ES content is exported, an app with a .spl extension is automatically created. What is the best practice when exporting and importing updates to ES content?

  A. Use new app names each time content is exported.

  B. Do not use the .spl extension when naming an export.

  C. Always include existing and new content for each export.

  D. Either use new app names or always include both existing and new content.

  Correct Answer: D

  Either use new app names each time (which could be difficult to manage) or make sure you always include all content (old and new) each time you export.

• Question 5:

  The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data. What data model should be checked for potential errors such as skipped searches?

  A. Web

  B. Risk

  C. Performance

  D. Authentication

  Correct Answer: D

  Reference: https://answers.splunk.com/answers/565482/how-to-resolve-skipped-scheduled-searches.html

• Question 6:

  Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events.

  How would the admin restrict these users from being able to change the status of Resolved notable events to Closed?

  A. In Enterprise Security, give the ess_user role the Own Notable Events permission.

  B. From the Status Configuration window select the Closed status. Remove ess_user from the status transitions for the Resolved status.

  C. From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the Closed status.

  D. From Splunk Access Controls, select the ess_user role and remove the edit_notable_events capability.

  Correct Answer: C

• Question 7:

  Which argument to the | tstats command restricts the search to summarized data only?

  A. summaries=t

  B. summaries=all

  C. summariesonly=t

  D. summariesonly=all

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Acceleratedatamodels

• Question 8:

  The option to create a Short ID for a notable event is located where?

  A. The Additional Fields.

  B. The Event Details.

  C. The Contributing Events.

  D. The Description.

  Correct Answer: B

  https://docs.splunk.com/Documentation/ES/6.4.1/User/Takeactiononanotableevent

• Question 9:

  Which of the following is part of tuning correlation searches for a new ES installation?

  A. Configuring correlation notable event index.

  B. Configuring correlation permissions.

  C. Configuring correlation adaptive responses.

  D. Configuring correlation result storage.

  Correct Answer: A

• Question 10:

  Which of the following are data models used by ES? (Choose all that apply)

  A. Web

  B. Anomalies

  C. Authentication

  D. Network Traffic

  Correct Answer: ACD

  Reference: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/datamodelsusedbyes/