Splunk SPLK-3001 Exam Questions Instant Access

Question 1

What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

AConfigure -> Incident Management -> Notable Event Statuses

BConfigure -> Content Management -> Type: Correlation Search

CConfigure -> Incident Management -> Incident Review Settings -> Event Management

DConfigure -> Incident Management -> Incident Review Settings -> Table Attributes

Answer : D

Question 2

The option to create a Short ID for a notable event is located where?

AThe Additional Fields.

BThe Event Details.

CThe Contributing Events.

DThe Description.

Answer : B

https://docs.splunk.com/Documentation/ES/6.4.1/User/Takeactiononanotableevent

Question 3

Where are attachments to investigations stored?

AKV Store

Bnotable index

Cattachments.csv lookup

D<splunk_home>/etc/apps/SA-Investigations/default/ui/views/attachments

Answer : A

Question 4

Which of the following is a recommended pre-installation step?

ADisable the default search app.

BConfigure search head forwarding.

CDownload the latest version of KV Store from MongoDBxom.

DInstall the latest Python distribution on the search head.

Answer : B

Question 5

Which argument to the | tstats command restricts the search to summarized data only?

Asummaries=t

Bsummaries=all

Csummariesonly=t

Dsummariesonly=all

Answer : C

Question 6

Which setting is used in indexes.conf to specify alternate locations for accelerated storage?

AthawedPath

BtstatsHomePath

CsummaryHomePath

DwarmToColdScript

Answer : B

Question 7

Which of the following is an adaptive action that is configured by default for ES?

ACreate notable event

BCreate new correlation search

CCreate investigation

DCreate new asset

Answer : A

Splunk Enterprise Security Certified Admin SPLK-3001 Exam Questions