[Q41-Q62] SPLK-3001 Exam Brain Dumps - Study Notes and Theory [Jan-2023]

NO.41 A security manager has been working with the executive team en long-range security goals. A primary goal for the team Is to Improve managing user risk in the organization. Which of the following ES features can help identify users accessing inappropriate web sites?

Configuring the identities lookup with user details to enrich notable event Information for forensic analysis.

Make sure the Authentication data model contains up-to-date events and is properly accelerated.

Configuring user and website watchlists so the User Activity dashboard will highlight unwanted user actions.

Use the Access Anomalies dashboard to identify unusual protocols being used to access corporate sites.

NO.42 ES needs to be installed on a search head with which of the following options?

No other apps.

Any other apps installed.

All apps removed except for TA-*.

Only default built-in and CIM-compliant apps.

NO.43 How is it possible to navigate to the list of currently-enabled ES correlation searches?

Configure -> Correlation Searches -> Select Status “Enabled”

Settings -> Searches, Reports, and Alerts -> Filter by Name of “Correlation”

Configure -> Content Management -> Select Type “Correlation” and Status “Enabled”

Settings -> Searches, Reports, and Alerts -> Select App of “SplunkEnterpriseSecuritySuite” and filter by “- Rule”

NO.44 The Add-On Builder creates Splunk Apps that start with what?

DA-

SA-

TA-

App-

NO.45 The Add-On Builder creates Splunk Apps that start with what?

DA-

SA-

TA-

App-

NO.46 To observe what network services are in use in a network’s activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?

Intrusion Center

Protocol Analysis

User Intelligence

Threat Intelligence

NO.47 Which of the following is part of tuning correlation searches for a new ES installation?

Configuring correlation notable event index.

Configuring correlation permissions.

Configuring correlation adaptive responses.

Configuring correlation result storage.

NO.48 Adaptive response action history is stored in which index?

cim_modactions

modular_history

cim_adaptiveactions

modular_action_history

NO.49 Who can delete an investigation?

ess_admin users only.

The investigation owner only.

The investigation owner and ess-admin.

The investigation owner and collaborators.

NO.50 An administrator is asked to configure an “Nslookup” adaptive response action, so that it appears as a selectable option in the notable event’s action menu when an analyst is working in the Incident Review dashboard.
What steps would the administrator take to configure this option?

Configure -> Content Management -> Type: Correlation Search -> Notable -> Nslookup

Configure -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

Configure -> Content Management -> Type: Correlation Search -> Notable -> Next Steps -> Nslookup

Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

NO.51 What do threat gen searches produce?

Threat Intel in KV Store collections.

Threat correlation searches.

Threat notables in the notable index.

Events in the threat_activity index.

NO.52 What feature of Enterprise Security downloads threat intelligence data from a web server?

Threat Service Manager

Threat Download Manager

Threat Intelligence Parser

Therat Intelligence Enforcement

NO.53 Which of the following are examples of sources for events in the endpoint security domain dashboards?

REST API invocations.

Investigation final results status.

Workstations, notebooks, and point-of-sale systems.

Lifecycle auditing of incidents, from assignment to resolution.

NO.54 What do threat gen searches produce?

Threat Intel in KV Store collections.

Threat correlation searches.

Threat notables in the notable index.

Events in the threat_activity index.

NO.55 Which of the following features can the Add-on Builder configure in a new add-on?

Expire data.

Normalize data.

Summarize data.

Translate data.

NO.56 An administrator wants to ensure that none of the ES indexed data could be compromised through tampering.
What feature would satisfy this requirement?

Index consistency.

Data integrity control.

Indexer acknowledgement.

Index access permissions.

NO.57 Which of the following are examples of sources for events in the endpoint security domain dashboards?

REST API invocations.

Investigation final results status.

Workstations, notebooks, and point-of-sale systems.

Lifecycle auditing of incidents, from assignment to resolution.

NO.58 Which indexes are searched by default for CIM data models?

notable and default

summary and notable

_internal and summary

All indexes

NO.59 A set of correlation searches are enabled at a new ES installation, and results are being monitored. One of the correlation searches is generating many notable events which, when evaluated, are determined to be false positives.
What is a solution for this issue?

Modify the correlation schedule and sensitivity for your site.

Disable acceleration for the correlation search to reduce storage requirements.

Suppress notable events from that correlation search.

Change the correlation search’s default status and severity.

NO.60 What kind of value is in the red box in this picture?

A risk score.

A source ranking.

An event priority.

An IP address rating.

NO.61 What is the main purpose of the Dashboard Requirements Matrix document?

Identifies on which data model(s) each dashboard depends.

Provides instructions for customizing each dashboard for local data models.

Identifies the searches used by the dashboards.

Identifies which data model(s) depend on each dashboard.

NO.62 Which columns in the Assets lookup are used to identify an asset in an event?

src, dvc, dest

cidr, port, netbios, saml

ip, mac, dns, nt_host

host, hostname, url, address

[Q41-Q62] SPLK-3001 Exam Brain Dumps – Study Notes and Theory [Jan-2023]

Leave a Reply Cancel reply

SPLK-3001 Practice Tests

Related Certifications

Recent Posts

Categories

Archives