SPLK-3001 Pre-Exam Practice Tests (Updated 100 Questions) [Q47-Q68] : Free valid test braindumps : http://free.validbraindumps.com

NEW QUESTION 47
What do threat gen searches produce?

Threat correlation searches.

Threat Intel in KV Store collections.

Threat notables in the notable index.

Events in the threat_activity index.

NEW QUESTION 48
Which of the following is an adaptive action that is configured by default for ES?

Create notable event

Create new correlation search

Create investigation

Create new asset

NEW QUESTION 49
Which of the following is part of tuning correlation searches for a new ES installation?

Configuring correlation notable event index.

Configuring correlation permissions.

Configuring correlation adaptive responses.

Configuring correlation result storage.

NEW QUESTION 50
What tools does the Risk Analysis dashboard provide?

High risk threats.

Notable event domains displayed by risk score.

A display of the highest risk assets and identities.

Key indicators showing the highest probability correlation searches in the environment.

NEW QUESTION 51
Which indexes are searched by default for CIM data models?

notable and default

summary and notable

_internal and summary

All indexes

NEW QUESTION 52
Which of the following are data models used by ES? (Choose all that apply)

Web

Anomalies

Authentication

Network Traffic

NEW QUESTION 53
Which argument to the | tstats command restricts the search to summarized data only?

summaries=t

summaries=all

summariesonly=t

summariesonly=all

NEW QUESTION 54
Which of the following are data models used by ES? (Choose all that apply.)

Web

Anomalies

Authentication

Network Traffic

NEW QUESTION 55
Where is it possible to export content, such as correlation searches, from ES?

Content exporter

Configure -> Content Management

Export content dashboard

Settings Menu -> ES -> Export

NEW QUESTION 56
Which of the following is a recommended pre-installation step?

Disable the default search app.

Configure search head forwarding.

Download the latest version of KV Store from MongoDBxom.

Install the latest Python distribution on the search head.

NEW QUESTION 57
Which of the following threat intelligence types can ES download? (Choose all that apply)

Text

STIX/TAXII

VulnScanSPL

SplunkEnterpriseThreatGenerator

NEW QUESTION 58
Which columns in the Assets lookup are used to identify an asset in an event?

src, dvc, dest

cidr, port, netbios, saml

ip, mac, dns, nt_host

host, hostname, url, address

NEW QUESTION 59
ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

$SPLUNK_HOME/etc/system/local/

$SPLUNK_HOME/var/run/searchpeers/

$SPLUNK_HOME/etc/shcluster/apps

$SPLUNK_HOME/etc/master-apps/

NEW QUESTION 60
Which correlation search feature is used to throttle the creation of notable events?

Schedule priority.

Window interval.

Window duration.

Schedule windows.

NEW QUESTION 61
An administrator is asked to configure an “Nslookup” adaptive response action, so that it appears as a selectable option in the notable event’s action menu when an analyst is working in the Incident Review dashboard. What steps would the administrator take to configure this option?

Configure -> Content Management -> Type: Correlation Search -> Notable -> Nslookup

Configure -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

Configure -> Content Management -> Type: Correlation Search -> Notable -> Next Steps -> Nslookup

Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions
-> Nslookup

NEW QUESTION 62
Which column in the Asset or Identity list is combined with event security to make a notable event’s urgency?

VIP

Priority

Importance

Criticality

NEW QUESTION 63
What does the risk framework add to an object (user, server or other type) to indicate increased risk?

An urgency.

A risk profile.

An aggregation.

A numeric score.

NEW QUESTION 64
ES needs to be installed on a search head with which of the following options?

No other apps.

Any other apps installed.

All apps removed except for TA-*.

Only default built-in and CIM-compliant apps.

NEW QUESTION 65
Which of the following threat intelligence types can ES download? (Choose all that apply)

Text

STIX/TAXII

VulnScanSPL

SplunkEnterpriseThreatGenerator

NEW QUESTION 66
Which of the following is a Web Intelligence dashboard?

Network Center

Endpoint Center

HTTP Category Analysis

stream :http Protocol dashboard

NEW QUESTION 67
Which of the following are examples of sources for events in the endpoint security domain dashboards?

REST API invocations.

Investigation final results status.

Workstations, notebooks, and point-of-sale systems.

Lifecycle auditing of incidents, from assignment to resolution.

NEW QUESTION 68
When installing Enterprise Security, what should be done after installing the add-ons necessary for normalizing data?

Nothing, there are no additional steps for add-ons.

Configure the add-ons via the Content Management dashboard.

Disable the add-ons until they are ready to be used, then enable the add-ons.

Configure the add-ons according to their README or documentation.