Splunk SPLK-3001 Free Practice Questions

NEW QUESTION 1
Adaptive response action history is stored in which index?

• A. cim_modactions
• B. modular_history
• C. cim_adaptiveactions
• D. modular_action_history

Answer: A

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Install/Indexes

NEW QUESTION 2
What is the first step when preparing to install ES?

• A. Install ES.
• B. Determine the data sources used.
• C. Determine the hardware required.
• D. Determine the size and scope of installation.

Answer: D

NEW QUESTION 3
ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

• A. $SPLUNK_HOME/etc/master-apps/
• B. $SPLUNK_HOME/etc/system/local/
• C. $SPLUNK_HOME/etc/shcluster/apps
• D. $SPLUNK_HOME/var/run/searchpeers/

Answer: C

Explanation:
The upgraded contents of the staging instance will be migrated back to the deployer and deployed to the search head cluster members. On the staging instance, copy $SPLUNK_HOME/etc/apps to $SPLUNK_HOME/etc/shcluster/apps on the deployer. 1. On the deployer, remove any deprecated apps or add-ons in $SPLUNK_HOME/etc/shcluster/apps that were removed during the upgrade on staging. Confirm by reviewing the ES upgrade report generated on staging, or by examining the apps moved into $SPLUNK_HOME/etc/disabled-apps on staging

NEW QUESTION 4
Where are attachments to investigations stored?

• A. KV Store
• B. notable index
• C. attachments.csv lookup
• D. <splunk_home>/etc/apps/SA-Investigations/default/ui/views/attachments

Answer: A

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Manageinvestigations

NEW QUESTION 5
At what point in the ES installation process should Splunk_TA_ForIndexes.spl be deployed to the indexers?

• A. When adding apps to the deployment server.
• B. Splunk_TA_ForIndexers.spl is installed first.
• C. After installing ES on the search head(s) and running the distributed configuration management tool.
• D. Splunk_TA_ForIndexers.spl is only installed on indexer cluster sites using the cluster master and the splunk apply cluster-bundle command.

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Install/InstallTechnologyAdd-ons

NEW QUESTION 6
The Add-On Builder creates Splunk Apps that start with what?

• A. DA-
• B. SA-
• C. TA-
• D. App-

Answer: C

Explanation:
Reference: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/abouttheessolution/

NEW QUESTION 7
To which of the following should the ES application be uploaded?

• A. The indexer.
• B. The KV Store.
• C. The search head.
• D. The dedicated forwarder.

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Install/InstallEnterpriseSecuritySHC

NEW QUESTION 8
Which of the following are data models used by ES? (Choose all that apply)

• A. Web
• B. Anomalies
• C. Authentication
• D. Network Traffic

Answer: B

Explanation:
Reference: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/datamodelsusedbyes/

NEW QUESTION 9
An administrator is provisioning one search head prior to installing ES. What are the reference minimum requirements for OS, CPU, and RAM for that machine?

• A. OS: 32 bit, RAM: 16 MB, CPU: 12 cores
• B. OS: 64 bit, RAM: 32 MB, CPU: 12 cores
• C. OS: 64 bit, RAM: 12 MB, CPU: 16 cores
• D. OS: 64 bit, RAM: 32 MB, CPU: 16 cores

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Capacity/Referencehardware

NEW QUESTION 10
Which of the following actions can improve overall search performance?

• A. Disable indexed real-time search.
• B. Increase priority of all correlation searches.
• C. Reduce the frequency (schedule) of lower-priority correlation searches.
• D. Add notable event suppressions for correlation searches with high numbers of false positives.

Answer: A

NEW QUESTION 11
ES needs to be installed on a search head with which of the following options?

• A. No other apps.
• B. Any other apps installed.
• C. All apps removed except for TA-*.
• D. Only default built-in and CIM-compliant apps.

Answer: A

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Install/InstallEnterpriseSecurity

NEW QUESTION 12
The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated. How can the correlation search be made less sensitive?

• A. Edit the search and modify the notable event status field to make the notable events less urgent.
• B. Edit the search, look for where or xswhere statements, and after the threshold value being compared to make it less common match.
• C. Edit the search, look for where or xswhere statements, and alter the threshold value being compared to make it a more common match.
• D. Modify the urgency table for this correlation search and add a new severity level to make notable events from this search less urgent.

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Howurgencyisassigned

NEW QUESTION 13
Which setting is used in indexes.conf to specify alternate locations for accelerated storage?

• A. thawedPath
• B. tstatsHomePath
• C. summaryHomePath
• D. warmToColdScript

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Acceleratedatamodels

NEW QUESTION 14
Glass tables can display static images and text, the results of ad-hoc searches, and which of the following objects?

• A. Lookup searches.
• B. Summarized data.
• C. Security metrics.
• D. Metrics store searches.

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/CreateGlassTable

NEW QUESTION 15
Which of the following are examples of sources for events in the endpoint security domain dashboards?

• A. REST API invocations.
• B. Investigation final results status.
• C. Workstations, notebooks, and point-of-sale systems.
• D. Lifecycle auditing of incidents, from assignment to resolution.

Answer: D

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/EndpointProtectionDomaindashboards

NEW QUESTION 16
Which indexes are searched by default for CIM data models?

• A. notable and default
• B. summary and notable
• C. _internal and summary
• D. All indexes

Answer: D

Explanation:
Reference: https://answers.splunk.com/answers/600354/indexes-searched-by-cim-data-models.html

NEW QUESTION 17
What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?

• A. ess_user
• B. ess_admin
• C. ess_analyst
• D. ess_reviewer

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Triagenotableevents

NEW QUESTION 18
What is the maximum recommended volume of indexing per day, per indexer, for a non-cloud (on-prem) ES deployment?

• A. 50 GB
• B. 100 GB
• C. 300 GB
• D. 500 MB

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.4.2/Install/Plan

NEW QUESTION 19
Which of the following threat intelligence types can ES download? (Choose all that apply)

• A. Text
• B. STIX/TAXII
• C. VulnScanSPL
• D. SplunkEnterpriseThreatGenerator

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Downloadthreatfeed

NEW QUESTION 20
Who can delete an investigation?

• A. ess_admin users only.
• B. The investigation owner only.
• C. The investigation owner and ess-admin.
• D. The investigation owner and collaborators.

Answer: A

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Manageinvestigations

NEW QUESTION 21
What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

• A. Configure -> Incident Management -> Notable Event Statuses
• B. Configure -> Content Management -> Type: Correlation Search
• C. Configure -> Incident Management -> Incident Review Settings -> Event Management
• D. Configure -> Incident Management -> Incident Review Settings -> Table Attributes

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Customizenotables

NEW QUESTION 22
Which column in the Asset or Identity list is combined with event security to make a notable event’s urgency?

• A. VIP
• B. Priority
• C. Importance
• D. Criticality

Answer: B

Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Howurgencyisassigned

NEW QUESTION 23
Which argument to the | tstats command restricts the search to summarized data only?

• A. summaries=t
• B. summaries=all
• C. summariesonly=t
• D. summariesonly=all

Answer: C

Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Acceleratedatamodels

NEW QUESTION 24
......