Splunk Splunk Certifications SPLK-3001 Questions & Answers

• Question 61:

  How is it possible to navigate to the ES graphical Navigation Bar editor?

  A. Configure -> Navigation Menu

  B. Configure -> General -> Navigation

  C. Settings -> User Interface -> Navigation -> Click on "Enterprise Security"

  D. Settings -> User Interface -> Navigation Menus -> Click on "default" next to SplunkEnterpriseSecuritySuite

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/ Customizemenubar#Restore_the_default_navigation

• Question 62:

  Both "Recommended Actions" and "Adaptive Response Actions" use adaptive response.

  How do they differ?

  A. Recommended Actions show a textual description to an analyst, Adaptive Response Actions show them encoded.

  B. Recommended Actions show a list of Adaptive Responses to an analyst, Adaptive Response Actions run them automatically.

  C. Recommended Actions show a list of Adaptive Responses that have already been run, Adaptive Response Actions run them automatically.

  D. Recommended Actions show a list of Adaptive Resposes to an analyst, Adaptive Response Actions run manually with analyst intervention.

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/ES/latest/Admin/Configureadaptiveresponse

• Question 63:

  Where should an ES search head be installed?

  A. On a Splunk server with top level visibility.

  B. On any Splunk server.

  C. On a server with a new install of Splunk.

  D. On a Splunk server running Splunk DB Connect.

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Export

• Question 64:

  Which data model populated the panels on the Risk Analysis dashboard?

  A. Risk

  B. Audit

  C. Domain analysis

  D. Threat intelligence

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/RiskAnalysis#Dashboard_panels

• Question 65:

  Where are attachments to investigations stored?

  A. KV Store

  B. notable index

  C. attachments.csv lookup D. /etc/apps/SA-Investigations/default/ui/views/attachments

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Manageinvestigations

• Question 66:

  Which settings indicated that the correlation search will be executed as new events are indexed?

  A. Always-On

  B. Real-Time

  C. Scheduled

  D. Continuous

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Configurecorrelationsearches

• Question 67:

  When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

  A. $fieldname$

  B. "fieldname"

  C. %fieldname%

  D. _fieldname_

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/ITSI/4.4.2/Configure/Createcorrelationsearch

• Question 68:

  How is notable event urgency calculated?

  A. Asset priority and threat weight.

  B. Alert severity found by the correlation search.

  C. Asset or identity risk and severity found by the correlation search.

  D. Severity set by the correlation search and priority assigned to the associated asset or identity.

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Howurgencyisassigned

• Question 69:

  How does ES know local customer domain names so it can detect internal vs. external emails?

  A. Web and email domain names are set in General -> General Configuration.

  B. ES uses the User Activity index and applies machine learning to determine internal and external domains.

  C. The Corporate Web and Email Domain Lookups are edited during initial configuration.

  D. ES extracts local email and web domains automatically from SMTP and HTTP logs.

  Correct Answer: C

• Question 70:

  Adaptive response action history is stored in which index?

  A. cim_modactions

  B. modular_history

  C. cim_adaptiveactions

  D. modular_action_history

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Install/Indexes