Free Splunk Enterprise Security Certified Admin Exam SPLK-3001 Exam Practice Test

Which of the following are examples of sources for events in the endpoint security domain dashboards?

• REST API invocations.
• Investigation final results status.
• Workstations, notebooks, and point-of-sale systems.
• Lifecycle auditing of incidents, from assignment to resolution.

What tools does the Risk Analysis dashboard provide?

• High risk threats.
• Notable event domains displayed by risk score.
• A display of the highest risk assets and identities.
• Key indicators showing the highest probability correlation searches in the environment.

Which of the following is a risk of using the Auto Deployment feature of Distributed Configuration Management to distribute indexes.conf?

• Indexes might crash.
• Indexes might be processing.
• Indexes might not be reachable.
• Indexes have different settings.

Which of the following threat intelligence types can ES download? (Choose all that apply)

• Text
• STIX/TAXII
• VulnScanSPL
• SplunkEnterpriseThreatGenerator

Which data model populated the panels on the Risk Analysis dashboard?

• Risk
• Audit
• Domain analysis
• Threat intelligence

What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?

• ess_user
• ess_admin
• ess_analyst
• ess_reviewer

Which of the following ES features would a security analyst use while investigating a network anomaly notable?

• Correlation editor.
• Key indicator search.
• Threat download dashboard.
• Protocol intelligence dashboard.

Which of the following is a key feature of a glass table?

• Rigidity.
• Customization.
• Interactive investigations.
• Strong data for later retrieval.

''10.22.63.159'', ''websvr4'', and ''00:26:08:18: CF:1D'' would be matched against what in ES?

• A user.
• A device.
• An asset.
• An identity.

A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?

• Install ES on the existing search head.
• Add a new search head and install ES on it.
• Increase the number of CPUs and amount of memory on the search head, then install ES.
• Delete the non-CIM-compliant apps from the search head, then install ES.