Breathing Splunk SPLK-3001 Questions Pool Online

NEW QUESTION 1
“10.22.63.159”, “websvr4”, and “00:26:08:18: CF:1D” would be matched against what in ES?

• A. A user.
• B. A device.
• C. An asset.
• D. An identity.

Answer: B

NEW QUESTION 2
How should an administrator add a new lookup through the ES app?

• A. Upload the lookup file in Settings -> Lookups -> Lookup Definitions
• B. Upload the lookup file in Settings -> Lookups -> Lookup table files
• C. Add the lookup file to /etc/apps/SplunkEnterpriseSecuritySuite/lookups
• D. Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup

Answer: D

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Createlookups

NEW QUESTION 3
Which settings indicated that the correlation search will be executed as new events are indexed?

• A. Always-On
• B. Real-Time
• C. Scheduled
• D. Continuous

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Configurecorrelationsearches

NEW QUESTION 4
At what point in the ES installation process should Splunk_TA_ForIndexes.spl be deployed to the indexers?

• A. When adding apps to the deployment server.
• B. Splunk_TA_ForIndexers.spl is installed first.
• C. After installing ES on the search head(s) and running the distributed configuration management tool.
• D. Splunk_TA_ForIndexers.spl is only installed on indexer cluster sites using the cluster master and the splunk apply cluster-bundle command.

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Install/InstallTechnologyAdd-ons

NEW QUESTION 5
Both “Recommended Actions” and “Adaptive Response Actions” use adaptive response. How do they differ?

• A. Recommended Actions show a textual description to an analyst, Adaptive Response Actions show them encoded.
• B. Recommended Actions show a list of Adaptive Responses to an analyst, Adaptive Response Actions run them automatically.
• C. Recommended Actions show a list of Adaptive Responses that have already been run, Adaptive Response Actions run them automatically.
• D. Recommended Actions show a list of Adaptive Resposes to an analyst, Adaptive Response Actions run manually with analyst intervention.

Answer: D

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/latest/Admin/Configureadaptiveresponse

NEW QUESTION 6
What does the Security Posture dashboard display?

• A. Active investigations and their status.
• B. A high-level overview of notable events.
• C. Current threats being tracked by the SOC.
• D. A display of the status of security tools.

Answer: B

Explanation:
The Security Posture dashboard is designed to provide high-level insight into the notable events across all domains of your deployment, suitable for display in a Security Operations Center (SOC). This dashboard shows all events from the past 24 hours, along with the trends over the past 24 hours, and provides real-time event information and updates.
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/SecurityPosturedashboard

NEW QUESTION 7
Where is it possible to export content, such as correlation searches, from ES?

• A. Content exporter
• B. Configure -> Content Management
• C. Export content dashboard
• D. Settings Menu -> ES -> Export

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Export

NEW QUESTION 8
Which argument to the | tstats command restricts the search to summarized data only?

• A. summaries=t
• B. summaries=all
• C. summariesonly=t
• D. summariesonly=all

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Acceleratedatamodels

NEW QUESTION 9
An administrator is asked to configure an “Nslookup” adaptive response action, so that it appears as a selectable option in the notable event’s action menu when an analyst is working in the Incident Review dashboard. What steps would the administrator take to configure this option?

• A. Configure -> Content Management -> Type: Correlation Search -> Notable -> Nslookup
• B. Configure -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup
• C. Configure -> Content Management -> Type: Correlation Search -> Notable -> Next Steps -> Nslookup
• D. Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

Answer: D

NEW QUESTION 10
What is the default schedule for accelerating ES Datamodels?

• A. 1 minute
• B. 5 minutes
• C. 15 minutes
• D. 1 hour

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Acceleratedatamodels

NEW QUESTION 11
Glass tables can display static images and text, the results of ad-hoc searches, and which of the following objects?

• A. Lookup searches.
• B. Summarized data.
• C. Security metrics.
• D. Metrics store searches.

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/CreateGlassTable

NEW QUESTION 12
Which indexes are searched by default for CIM data models?

• A. notable and default
• B. summary and notable
• C. _internal and summary
• D. All indexes

Answer: D

Explanation:
Reference: https://answers.splunk.com/answers/600354/indexes-searched-by-cim-data-models.html

NEW QUESTION 13
What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

• A. Configure -> Incident Management -> Notable Event Statuses
• B. Configure -> Content Management -> Type: Correlation Search
• C. Configure -> Incident Management -> Incident Review Settings -> Event Management
• D. Configure -> Incident Management -> Incident Review Settings -> Table Attributes

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Customizenotables

NEW QUESTION 14
Adaptive response action history is stored in which index?

• A. cim_modactions
• B. modular_history
• C. cim_adaptiveactions
• D. modular_action_history

Answer: A

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Install/Indexes

NEW QUESTION 15
Where is the Add-On Builder available from?

• A. GitHub
• B. SplunkBase
• C. www.splunk.com
• D. The ES installation package

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/AddonBuilder/3.0.1/UserGuide/Installation

NEW QUESTION 16
When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

• A. $fieldname$
• B. “fieldname”
• C. %fieldname%
• D. _fieldname_

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.4.2/Configure/Createcorrelationsearch

NEW QUESTION 17
Which of the following are examples of sources for events in the endpoint security domain dashboards?

• A. REST API invocations.
• B. Investigation final results status.
• C. Workstations, notebooks, and point-of-sale systems.
• D. Lifecycle auditing of incidents, from assignment to resolution.

Answer: D

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/EndpointProtectionDomaindashboards

NEW QUESTION 18
In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?

• A. Save the settings.
• B. Apply the correct tags.
• C. Run the correct search.
• D. Visit the CIM dashboard.

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizeOSSECdata

NEW QUESTION 19
The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data. What data model should be checked for potential errors such as skipped searches?

• A. Web
• B. Risk
• C. Performance
• D. Authentication

Answer: A

Explanation:
Reference: https://answers.splunk.com/answers/565482/how-to-resolve-skipped-scheduled-searches.html

NEW QUESTION 20
The Add-On Builder creates Splunk Apps that start with what?

• A. DA-
• B. SA-
• C. TA-
• D. App-

Answer: C

Explanation:
Reference: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/abouttheessolution/

NEW QUESTION 21
Which column in the Asset or Identity list is combined with event security to make a notable event’s urgency?

• A. VIP
• B. Priority
• C. Importance
• D. Criticality

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Howurgencyisassigned

NEW QUESTION 22
......