Splunk SPLK-3001 Splunk Enterprise Security Certified Admin Exam Exam Practice Test Questions

• Question 1

  Which of the following is a recommended pre-installation step?

  • Disable the default search app.
  • Configure search head forwarding.
  • Download the latest version of KV Store from MongoDBxom.
  • Install the latest Python distribution on the search head.

  Show Answer Answer: B Next

• Question 2

  To which of the following should the ES application be uploaded?

  • The indexer.
  • The KV Store.
  • The search head.
  • The dedicated forwarder.

  Show Answer Answer: C Next

• Question 3

  When installing Enterprise Security, what should be done after installing the add-ons necessary for normalizing data?

  • Configure the add-ons according to their README or documentation.
  • Disable the add-ons until they are ready to be used, then enable the add-ons.
  • Nothing, there are no additional steps for add-ons.
  • Configure the add-ons via the Content Management dashboard.

  Show Answer Answer: A Next

• Question 4

  Which of the following features can the Add-on Builder configure in a new add-on?

  • Expire data.
  • Normalize data.
  • Summarize data.
  • Translate data.

  Show Answer Answer: B Next

• Question 5

  How is notable event urgency calculated?

  • Asset priority and threat weight.
  • Alert severity found by the correlation search.
  • Asset or identity risk and severity found by the correlation search.
  • Severity set by the correlation search and priority assigned to the associated asset or identity.

  Show Answer Answer: D Next