Splunk SPLK-3001 Splunk Enterprise Security Certified Admin Online Training

Splunk SPLK-3001 Online Training

The questions for SPLK-3001 were last updated at Apr 17,2024.

Exam Code: SPLK-3001
Exam Name: Splunk Enterprise Security Certified Admin
Certification Provider: Splunk
Latest update: Apr 17,2024

Question #1

Which of the following are data models used by ES? (Choose all that apply)

A . Web
B . Anomalies
C . Authentication
D . Network Traffic

Correct Answer: A,C,D
A,C,D

Explanation:

Reference: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/datamodelsusedbyes/

Question #2

In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?

A . Save the settings.
B . Apply the correct tags.
C . Run the correct search.
D . Visit the CIM dashboard.

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizeOSSECdata

Question #3

A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance .

What is the best practice for installing ES?

A . Install ES on the existing search head.
B . Add a new search head and install ES on it.
C . Increase the number of CPUs and amount of memory on the search head, then install ES.
D . Delete the non-CIM-compliant apps from the search head, then install ES.

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

Reference: https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf

Question #4

What are adaptive responses triggered by?

A . By correlation searches and users on the incident review dashboard.
B . By correlation searches and custom tech add-ons.
C . By correlation searches and users on the threat analysis dashboard.
D . By custom tech add-ons and users on the risk analysis dashboard.

Reveal Solution Hide Solution

Correct Answer: D

Question #5

When investigating, what is the best way to store a newly-found IOC?

A . Paste it into Notepad.
B . Click the “Add IOC” button.
C . Click the “Add Artifact” button.
D . Add it in a text note to the investigation.

Reveal Solution Hide Solution

Correct Answer: C

Question #6

A security manager has been working with the executive team en long-range security goals. A primary goal for the team Is to Improve managing user risk in the organization .

Which of the following ES features can help identify users accessing inappropriate web sites?

A . Configuring the identities lookup with user details to enrich notable event Information for forensic analysis.
B . Make sure the Authentication data model contains up-to-date events and is properly accelerated.
C . Configuring user and website watchlists so the User Activity dashboard will highlight unwanted user actions.
D . Use the Access Anomalies dashboard to identify unusual protocols being used to access corporate sites.

Reveal Solution Hide Solution

Correct Answer: C

Question #7

When using distributed configuration management to create the Splunk_TA_ForIndexers package, which three files can be included?

A . indexes.conf, props.conf, transforms.conf
B . web.conf, props.conf, transforms.conf
C . inputs.conf, props.conf, transforms.conf
D . eventtypes.conf, indexes.conf, tags.conf

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

Reference: https://docs.splunk.com/Documentation/ES/6.4.1/Install/InstallTechnologyAdd-ons

Question #8

After installing Enterprise Security, the distributed configuration management tool can be used to create which app to configure indexers?

A . Splunk_DS_ForIndexers.spl
B . Splunk_ES_ForIndexers.spl
C . Splunk_SA_ForIndexers.spl
D . Splunk_TA_ForIndexers.spl

Reveal Solution Hide Solution

Correct Answer: D
D

Explanation:

Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Install/InstallTechnologyAdd-ons

Question #9

When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?