Splunk Splunk Certifications SPLK-3001 Questions & Answers

• Question 51:

  What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

  A. Configure -> Incident Management -> Notable Event Statuses

  B. Configure -> Content Management -> Type: Correlation Search

  C. Configure -> Incident Management -> Incident Review Settings -> Event Management

  D. Configure -> Incident Management -> Incident Review Settings -> Table Attributes

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Customizenotables

• Question 52:

  To observe what network services are in use in a network's activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?

  A. Intrusion Center

  B. Protocol Analysis

  C. User Intelligence

  D. Threat Intelligence

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/NetworkProtectionDomaindashboards

• Question 53:

  How should an administrator add a new lookup through the ES app?

  A. Upload the lookup file in Settings -> Lookups -> Lookup Definitions

  B. Upload the lookup file in Settings -> Lookups -> Lookup table files

  C. Add the lookup file to /etc/apps/SplunkEnterpriseSecuritySuite/lookups

  D. Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Createlookups

• Question 54:

  Which setting is used in indexes.conf to specify alternate locations for accelerated storage?

  A. thawedPath

  B. tstatsHomePath

  C. summaryHomePath

  D. warmToColdScript

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Acceleratedatamodels

• Question 55:

  Accelerated data requires approximately how many times the daily data volume of additional storage space per year?

  A. 3.4

  B. 5.7

  C. 1.0

  D. 2.5

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/ES/6.4.1/Install/Datamodels

• Question 56:

  When investigating, what is the best way to store a newly-found IOC?

  A. Paste it into Notepad.

  B. Click the "Add IOC" button.

  C. Click the "Add Artifact" button.

  D. Add it in a text note to the investigation.

  Correct Answer: C

• Question 57:

  Glass tables can display static images and text, the results of ad-hoc searches, and which of the following objects?

  A. Lookup searches.

  B. Summarized data.

  C. Security metrics.

  D. Metrics store searches.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/CreateGlassTable

• Question 58:

  Which of the following lookup types in Enterprise Security contains information about known hostile IP addresses?

  A. Security domains.

  B. Threat intel.

  C. Assets.

  D. Domains.

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Manageinternallookups

• Question 59:

  Who can delete an investigation?

  A. ess_admin users only.

  B. The investigation owner only.

  C. The investigation owner and ess-admin.

  D. The investigation owner and collaborators.

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Manageinvestigations

• Question 60:

  Which tool Is used to update indexers In E5?

  A. Index Updater

  B. Distributed Configuration Management

  C. indexes.conf

  D. Splunk_TA_ForIndexeres. spl

  Correct Answer: B