最新的Splunk Enterprise Security Certified Admin認證 SPLK-3001考試題庫

問題1

At what point in the ES installation process should Splunk_TA_ForIndexers.spl be deployed to the indexers?

A. Splunk_TA_ForIndexers.spl is installed first.

B. When adding apps to the deployment server.

C. Splunk_TA_ForIndexers.spl is only installed on indexer cluster sites using the cluster master and the splunk apply cluster-bundle command.

D. After installing ES on the search head(s) and running the distributed configuration management tool.

正確答案: D

問題2

Which lookup table does the Default Account Activity Detected correlation search use to flag known default accounts?

A. Privileged Accounts

B. Identities

C. Local User Intel

D. Administrative Identities

正確答案: D

問題3

Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

A. SplunkWeb (8000), Splunk Management (8089), KV Store (8191)

B. SplunkWeb (8088), Splunk Management (8089), KV Store (8000)

C. SplunkWeb (8043), Splunk Management (8088), KV Store (8191)

D. SplunkWeb (8386), Splunk Management (8926), KV Store (8106)

正確答案: A

說明：（僅 VCESoft 成員可見）

問題4

Where are attachments to investigations stored?

A. <splunk_home>/etc/apps/SA-Investigations/default/ui/views/attachments

B. attachments.csv lookup

C. notable index

D. KV Store

正確答案: D

說明：（僅 VCESoft 成員可見）

問題5

Which dashboard in Splunk Enterprise Security provides visibility into active security investigations?

A. Asset investigator dashboard displays enriched host and user contextual relationships.

B. Incident review dashboard tracks and manages notable events during investigations.

C. Threat activity dashboard summarizes malware trends across monitored enterprise endpoints.

D. Executive summary dashboard visualizes organizational security posture for leadership reporting.

正確答案: B

說明：（僅 VCESoft 成員可見）

問題6

What can be exported from ES using the Content Management page?

A. Only correlation searches, managed lookups, and glass tables.

B. Only correlation searches.

C. Only correlation searches, glass tables, and workbench panels.

D. Any content type listed in the Content Management page.

正確答案: D

說明：（僅 VCESoft 成員可見）

問題7

'10.22.63.159', 'websvr4', and '00:26:08:18: CF:1D' would be matched against what in ES?

A. An asset.

B. A device.

C. A user.

D. An identity.

正確答案: A

說明：（僅 VCESoft 成員可見）

問題8

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.
Which of the following options is most likely to help performance?

A. Increase memory and CPUs on the search head(s) and add additional indexers.

B. Add heavy forwarders between the universal forwarders and indexers so inputs can be parsed before indexing.

C. Change the search heads to do local indexing of summary searches.

D. If indexed realtime search is enabled, disable it for the notable index.

正確答案: A

問題9

What is the default schedule for accelerating ES Datamodels?

A. 1 minute

B. 15 minutes

C. 5 minutes

D. 1 hour

正確答案: C

說明：（僅 VCESoft 成員可見）

問題10

Which Splunk ES feature automatically prioritizes notable events by predefined security risk scores?

A. Adaptive response actions trigger automated remediation after notable event generation.

B. Data model acceleration improves search speed across indexed enterprise datasets.

C. Asset and identity correlation enriches events with contextual organizational metadata.

D. Risk-based alerting calculates cumulative entity risk from correlated detections.

正確答案: D

說明：（僅 VCESoft 成員可見）

最新的Splunk Enterprise Security Certified Admin - SPLK-3001免費考試真題

最新更新

站內鏈接

聯系我們