Splunk SPLK-3001 Exam Questions Instant Access

Question 1

Which two fields combine to create the Urgency of a notable event?

APriority and Severity.

BPriority and Criticality.

CCriticality and Severity.

DPrecedence and Time.

Answer : A

Question 2

Where are attachments to investigations stored?

AKV Store

Bnotable index

Cattachments.csv lookup

D<splunk_home>/etc/apps/SA-Investigations/default/ui/views/attachments

Answer : A

Question 3

Which of the following steps will make the Threat Activity dashboard the default landing page in ES?

AFrom the Edit Navigation page, drag and drop the Threat Activity view to the top of the page.

BFrom the Preferences menu for the user, select Enterprise Security as the default application.

CFrom the Edit Navigation page, click the 'Set this as the default view' checkmark for Threat Activity.

DEdit the Threat Activity view settings and checkmark the Default View option.

Answer : C

Question 4

The option to create a Short ID for a notable event is located where?

AThe Additional Fields.

BThe Event Details.

CThe Contributing Events.

DThe Description.

Answer : B

https://docs.splunk.com/Documentation/ES/6.4.1/User/Takeactiononanotableevent

Question 5

Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

ASplunkWeb (8068), Splunk Management (8089), KV Store (8000)

BSplunkWeb (8390), Splunk Management (8323), KV Store (8672)

CSplunkWeb (8000), Splunk Management (8089), KV Store (8191)

DSplunkWeb (8043), Splunk Management (8088), KV Store (8191)

Answer : C

https://docs.splunk.com/Documentation/Splunk/8.1.2/Security/SecureSplunkonyournetwork

Question 6

Where is it possible to export content, such as correlation searches, from ES?

AContent exporter

BConfigure -> Content Management

CExport content dashboard

DSettings Menu -> ES -> Export

Answer : B

Question 7

Who can delete an investigation?

Aess_admin users only.

BThe investigation owner only.

CThe investigation owner and ess-admin.

DThe investigation owner and collaborators.

Answer : A

Splunk Enterprise Security Certified Admin SPLK-3001 Exam Questions