Free Practice Questions for Splunk SPLK-3001 Exam

Question 1

When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

A$fieldname$

B''fieldname''

C%fieldname%

D_fieldname_

Correct Answer: A. $fieldname$

Question 2

How is it possible to navigate to the list of currently-enabled ES correlation searches?

AConfigure -> Correlation Searches -> Select Status ''Enabled''

BSettings -> Searches, Reports, and Alerts -> Filter by Name of ''Correlation''

CConfigure -> Content Management -> Select Type ''Correlation'' and Status ''Enabled''

DSettings -> Searches, Reports, and Alerts -> Select App of ''SplunkEnterpriseSecuritySuite'' and filter by ''- Rule''

Correct Answer: C. Configure -> Content Management -> Select Type ''Correlation'' and Status ''Enabled''

Question 3

Which component normalizes events?

ASA-CIM.

BSA-Notable.

CES application.

DTechnology add-on.

Correct Answer: A. SA-CIM.

Question 4

How is notable event urgency calculated?

AAsset priority and threat weight.

BAlert severity found by the correlation search.

CAsset or identity risk and severity found by the correlation search.

DSeverity set by the correlation search and priority assigned to the associated asset or identity.

Correct Answer: D. Severity set by the correlation search and priority assigned to the associated asset or identity.

Question 5

Which of the following would allow an add-on to be automatically imported into Splunk Enterprise Security?

AA prefix of CIM_

BA suffix of .spl

CA prefix of TECH_

DA prefix of Splunk_TA_

Correct Answer: D. A prefix of Splunk_TA_

Question 6

What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

AConfigure -> Incident Management -> Notable Event Statuses

BConfigure -> Content Management -> Type: Correlation Search

CConfigure -> Incident Management -> Incident Review Settings -> Event Management

DConfigure -> Incident Management -> Incident Review Settings -> Table Attributes

Correct Answer: D. Configure -> Incident Management -> Incident Review Settings -> Table Attributes

Question 7

What is the maximum recommended volume of indexing per day, per indexer, for a non-cloud (on-prem) ES deployment?

A50 GB

B100 GB

C300 GB

D500 MB

Correct Answer: B. 100 GB

Question 8

An administrator is asked to configure an ''Nslookup'' adaptive response action, so that it appears as a selectable option in the notable event's action menu when an analyst is working in the Incident Review dashboard. What steps would the administrator take to configure this option?

AConfigure -> Content Management -> Type: Correlation Search -> Notable -> Nslookup

BConfigure -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

CConfigure -> Content Management -> Type: Correlation Search -> Notable -> Next Steps -> Nslookup

DConfigure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

Correct Answer: D. Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

Question 9

Which of these Is a benefit of data normalization?

AReports run faster because normalized data models can be optimized for better performance.

BDashboards take longer to build.

CSearches can be built no matter the specific source technology for a normalized data type.

DForwarder-based inputs are more efficient.

Correct Answer: A. Reports run faster because normalized data models can be optimized for better performance.

Question 10

Which two fields combine to create the Urgency of a notable event?

APriority and Severity.

BPriority and Criticality.

CCriticality and Severity.

DPrecedence and Time.

Correct Answer: A. Priority and Severity.