Splunk SPLK-3001 Real 2021 Braindumps Mock Exam Dumps
SPLK-3001 Exam Questions | Real SPLK-3001 Practice Dumps
NEW QUESTION 54
To observe what network services are in use in a network's activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?
- A. User Intelligence
- B. Protocol Analysis
- C. Intrusion Center
- D. Threat Intelligence
Answer: C
Explanation:
Explanation
NEW QUESTION 55
An administrator is provisioning one search head prior to installing ES. What are the reference minimum requirements for OS, CPU, and RAM for that machine?
- A. OS: 32 bit, RAM: 16 MB, CPU: 12 cores
- B. OS: 64 bit, RAM: 32 MB, CPU: 12 cores
- C. OS: 64 bit, RAM: 12 MB, CPU: 16 cores
- D. OS: 64 bit, RAM: 32 MB, CPU: 16 cores
Answer: C
Explanation:
Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.2/Capacity/Referencehardware
NEW QUESTION 56
ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?
- A. $SPLUNK_HOME/etc/system/local/
- B. $SPLUNK_HOME/etc/master-apps/
- C. $SPLUNK_HOME/var/run/searchpeers/
- D. $SPLUNK_HOME/etc/shcluster/apps
Answer: D
Explanation:
Explanation
The upgraded contents of the staging instance will be migrated back to the deployer and deployed to the search head cluster members. On the staging instance, copy $SPLUNK_HOME/etc/apps to
$SPLUNK_HOME/etc/shcluster/apps on the deployer. 1. On the deployer, remove any deprecated apps or add-ons in $SPLUNK_HOME/etc/shcluster/apps that were removed during the upgrade on staging. Confirm by reviewing the ES upgrade report generated on staging, or by examining the apps moved into
$SPLUNK_HOME/etc/disabled-apps on staging
NEW QUESTION 57
Which component normalizes events?
- A. SA-CIM.
- B. SA-Notable.
- C. ES application.
- D. Technology add-on.
Answer: A
Explanation:
Reference:
https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime
NEW QUESTION 58
What kind of value is in the red box in this picture?
- A. A source ranking.
- B. A risk score.
- C. An event priority.
- D. An IP address rating.
Answer: B
NEW QUESTION 59
Which of the following threat intelligence types can ES download? (Choose all that apply)
- A. VulnScanSPL
- B. STIX/TAXII
- C. Text
- D. SplunkEnterpriseThreatGenerator
Answer: B
Explanation:
Reference:
https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Downloadthreatfeed
NEW QUESTION 60
What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?
- A. ess_user
- B. ess_reviewer
- C. ess_admin
- D. ess_analyst
Answer: C
Explanation:
Reference:
https://docs.splunk.com/Documentation/ES/6.1.0/User/Triagenotableevents
NEW QUESTION 61
Glass tables can display static images and text, the results of ad-hoc searches, and which of the following objects?
- A. Security metrics.
- B. Summarized data.
- C. Metrics store searches.
- D. Lookup searches.
Answer: A
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/CreateGlassTable
NEW QUESTION 62
A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?
- A. Increase the number of CPUs and amount of memory on the search head, then install ES.
- B. Add a new search head and install ES on it.
- C. Install ES on the existing search head.
- D. Delete the non-CIM-compliant apps from the search head, then install ES.
Answer: B
Explanation:
Explanation/Reference: https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf
NEW QUESTION 63
What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?
- A. Configure -> Content Management -> Type: Correlation Search
- B. Configure -> Incident Management -> Incident Review Settings -> Table Attributes
- C. Configure -> Incident Management -> Incident Review Settings -> Event Management
- D. Configure -> Incident Management -> Notable Event Statuses
Answer: B
NEW QUESTION 64
Both "Recommended Actions" and "Adaptive Response Actions" use adaptive response. How do they differ?
- A. Recommended Actions show a list of Adaptive Responses that have already been run, Adaptive Response Actions run them automatically.
- B. Recommended Actions show a list of Adaptive Resposes to an analyst, Adaptive Response Actions run manually with analyst intervention.
- C. Recommended Actions show a list of Adaptive Responses to an analyst, Adaptive Response Actions run them automatically.
- D. Recommended Actions show a textual description to an analyst, Adaptive Response Actions show them encoded.
Answer: B
Explanation:
Reference:
https://docs.splunk.com/Documentation/ES/latest/Admin/Configureadaptiveresponse
NEW QUESTION 65
Which of the following threat intelligence types can ES download? (Choose all that apply)
- A. VulnScanSPL
- B. Text
- C. STIX/TAXII
- D. SplunkEnterpriseThreatGenerator
Answer: B,C
NEW QUESTION 66
Which of the following ES features would a security analyst use while investigating a network anomaly notable?
- A. Threat download dashboard.
- B. Key indicator search.
- C. Protocol intelligence dashboard.
- D. Correlation editor.
Answer: C
Explanation:
Reference:
https://www.splunk.com/en_us/products/premium-solutions/splunk-enterprise-security/ features.html
NEW QUESTION 67
Which of the following ES features would a security analyst use while investigating a network anomaly notable?
- A. Threat download dashboard.
- B. Key indicator search.
- C. Protocol intelligence dashboard.
- D. Correlation editor.
Answer: C
NEW QUESTION 68
Which of the following actions may be necessary before installing ES?
- A. Add additional forwarders.
- B. Redirect distributed search connections.
- C. Purge KV Store.
- D. Add additional indexers.
Answer: D
NEW QUESTION 69
An administrator is asked to configure an "Nslookup" adaptive response action, so that it appears as a selectable option in the notable event's action menu when an analyst is working in the Incident Review dashboard.
What steps would the administrator take to configure this option?
- A. Configure -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup
- B. Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup
- C. Configure -> Content Management -> Type: Correlation Search -> Notable -> Nslookup
- D. Configure -> Content Management -> Type: Correlation Search -> Notable -> Next Steps -> Nslookup
Answer: B
NEW QUESTION 70
How is it possible to navigate to the list of currently-enabled ES correlation searches?
- A. Settings -> Searches, Reports, and Alerts -> Select App of "SplunkEnterpriseSecuritySuite" and filter by "- Rule"
- B. Configure -> Correlation Searches -> Select Status "Enabled"
- C. Configure -> Content Management -> Select Type "Correlation" and Status "Enabled"
- D. Settings -> Searches, Reports, and Alerts -> Filter by Name of "Correlation"
Answer: B
Explanation:
Explanation
Explanation/Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Listcorrelationsearches
NEW QUESTION 71
Accelerated data requires approximately how many times the daily data volume of additional storage space per year?
- A. 1.0
- B. 5.7
- C. 2.5
- D. 3.4
Answer: D
NEW QUESTION 72
What is the first step when preparing to install ES?
- A. Install ES.
- B. Determine the data sources used.
- C. Determine the hardware required.
- D. Determine the size and scope of installation.
Answer: D
Explanation:
Explanation/Reference:
NEW QUESTION 73
How is it possible to specify an alternate location for accelerated storage?
- A. Use the tstatsHomePath setting in props, conf
- B. Configure storage optimization settings for the index.
- C. Update the Home Path setting in indexes, conf
- D. Use the tstatsHomePath Setting in indexes, conf
Answer: A
NEW QUESTION 74
Which of the following are examples of sources for events in the endpoint security domain dashboards?
- A. REST API invocations.
- B. Workstations, notebooks, and point-of-sale systems.
- C. Investigation final results status.
- D. Lifecycle auditing of incidents, from assignment to resolution.
Answer: D
NEW QUESTION 75
An administrator wants to ensure that none of the ES indexed data could be compromised through tampering. What feature would satisfy this requirement?
- A. Data integrity control.
- B. Index consistency.
- C. Indexer acknowledgement.
- D. Index access permissions.
Answer: A
Explanation:
Reference:
the.html
NEW QUESTION 76
......
Verified SPLK-3001 Exam Dumps Q&As - Provide SPLK-3001 with Correct Answers: https://pdfexamfiles.actualtestsquiz.com/SPLK-3001-test-torrent.html
