Splunk Splunk Certifications SPLK-3001 Questions & Answers

• Question 71:

  Enterprise Security's dashboards primarily pull data from what type of knowledge object?

  A. Tstats

  B. KV Store

  C. Data models

  D. Dynamic lookups

  Correct Answer: C

  Reference: https://docs.splunk.com/Splexicon:Knowledgeobject

• Question 72:

  ES needs to be installed on a search head with which of the following options?

  A. No other apps.

  B. Any other apps installed.

  C. All apps removed except for TA-*.

  D. Only default built-in and CIM-compliant apps.

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Install/InstallEnterpriseSecurity

• Question 73:

  ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

  A. $SPLUNK_HOME/etc/master-apps/

  B. $SPLUNK_HOME/etc/system/local/

  C. $SPLUNK_HOME/etc/shcluster/apps

  D. $SPLUNK_HOME/var/run/searchpeers/

  Correct Answer: C

  The upgraded contents of the staging instance will be migrated back to the deployer and deployed to the search head cluster members. On the staging instance, copy $SPLUNK_HOME/etc/apps to $SPLUNK_HOME/etc/shcluster/apps on the deployer. 1. On the deployer, remove any deprecated apps or add-ons in $SPLUNK_HOME/etc/shcluster/apps that were removed during the upgrade on staging. Confirm by reviewing the ES upgrade report generated on staging, or by examining the apps moved into $SPLUNK_HOME/etc/disabled-apps on staging

• Question 74:

  If a username does not match the `identity' column in the identities list, which column is checked next?

  A. Email.

  B. Nickname

  C. IP address.

  D. Combination of Last Name, First Name.

  Correct Answer: A

• Question 75:

  When installing Enterprise Security, what should be done after installing the add-ons necessary for normalizing data?

  A. Configure the add-ons according to their README or documentation.

  B. Disable the add-ons until they are ready to be used, then enable the add-ons.

  C. Nothing, there are no additional steps for add-ons.

  D. Configure the add-ons via the Content Management dashboard.

  Correct Answer: A

• Question 76:

  Which columns in the Assets lookup are used to identify an asset in an event?

  A. src, dvc, dest

  B. cidr, port, netbios, saml

  C. ip, mac, dns, nt_host

  D. host, hostname, url, address

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/ES/6.4.1/Admin/Formatassetoridentitylist

• Question 77:

  Where is the Add-On Builder available from?

  A. GitHub

  B. SplunkBase

  C. www.splunk.com

  D. The ES installation package

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/AddonBuilder/3.0.1/UserGuide/Installation

• Question 78:

  Which of the following ES features would a security analyst use while investigating a network anomaly notable?

  A. Correlation editor.

  B. Key indicator search.

  C. Threat download dashboard.

  D. Protocol intelligence dashboard.

  Correct Answer: D

  Reference: https://www.splunk.com/en_us/products/premium-solutions/splunk-enterprise-security/ features.html

• Question 79:

  Which of the following features can the Add-on Builder configure in a new add-on?

  A. Expire data.

  B. Normalize data.

  C. Summarize data.

  D. Translate data.

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/AddonBuilder/3.0.1/UserGuide/Overview

• Question 80:

  Which of the following is a risk of using the Auto Deployment feature of Distributed Configuration Management to distribute indexes.conf?

  A. Indexes might crash.

  B. Indexes might be processing.

  C. Indexes might not be reachable.

  D. Indexes have different settings.

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Indexesconf