SPLK-3001 実際試験問題と解答 - 模擬練習 - 受験自信を増やす

/ 2

Question No : 1
How is it possible to navigate to the list of currently-enabled ES correlation searches?

A.Configure -> Correlation Searches -> Select Status “Enabled”
B.Settings -> Searches, Reports, and Alerts -> Filter by Name of “Correlation”
C.Configure -> Content Management -> Select Type “Correlation” and Status “Enabled”
D.Settings -> Searches, Reports, and Alerts -> Select App of “SplunkEnterpriseSecuritySuite” and filter by “-Rule”

正解:
Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Listcorrelationsearches

Question No : 2
When investigating, what is the best way to store a newly-found IOC?

A.Paste it into Notepad.
B.Click the “Add IOC” button.
C.Click the “Add Artifact” button.
D.Add it in a text note to the investigation.

正解:

Question No : 3
Which argument to the | tstats command restricts the search to summarized data only?

A.summaries=t
B.summaries=all
C.summariesonly=t
D.summariesonly=all

正解:
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Acceleratedatamodels

Question No : 4
Which of the following is a way to test for a property normalized data model?

A.Use Audit -> Normalization Audit and check the Errors panel.
B.Run a | datamodelsearch, compare results to the CIM documentation for the datamodel.
C.Run a | loadjobsearch, look at tag values and compare them to known tags based on the encoding.
D.Run a | datamodelsearch and compare the results to the list of data models in the ES normalization guide.

正解:
Explanation:
Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/ UsetheCIMtonormalizedataatsearchtime

Question No : 5
Which setting is used in indexes.confto specify alternate locations for accelerated storage?

A.thawedPath
B.tstatsHomePath
C.summaryHomePath
D.warmToColdScript

正解:
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Acceleratedatamodels

Question No : 6
Which indexes are searched by default for CIM data models?

A.notableand default
B.summaryand notable
C._internaland summary
D.All indexes

正解:
Explanation:
Reference: https://answers.splunk.com/answers/600354/indexes-searched-by-cim-data-models.html

Question No : 7
What does the risk framework add to an object (user, server or other type) to indicate increased risk?

A.An urgency.
B.A risk profile.
C.An aggregation.
D.A numeric score.

正解:
Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/RiskScoring

Question No : 8
Which column in the Asset or Identity list is combined with event security to make a notable event’s urgency?

A.VIP
B.Priority
C.Importance
D.Criticality

正解:
Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Howurgencyisassigned

Question No : 9
What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?

A.ess_user
B.ess_admin
C.ess_analyst
D.ess_reviewer

正解:
Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Triagenotableevents

Question No : 10
In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?

A.Save the settings.
B.Apply the correct tags.
C.Run the correct search.
D.Visit the CIM dashboard.

正解:
Explanation:
Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizeOSSECdata

Question No : 11
The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data.
What data model should be checked for potential errors such as skipped searches?

A.Web
B.Risk
C.Performance
D.Authentication

正解:
Explanation:
Reference: https://answers.splunk.com/answers/565482/how-to-resolve-skipped-scheduled-searches.html

Question No : 12
What feature of Enterprise Security downloads threat intelligence data from a web server?

A.Threat Service Manager
B.Threat Download Manager
C.Threat Intelligence Parser
D.Threat Intelligence Enforcement

正解:

Question No : 13
When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

A.$fieldname$
B.“fieldname”
C.%fieldname%
D._fieldname_

正解:
Explanation:
Reference: https://docs.splunk.com/Documentation/ITSI/4.4.2/Configure/Createcorrelationsearch

Question No : 14
Which of the following are examples of sources for events in the endpoint security domain dashboards?

A.REST API invocations.
B.Investigation final results status.
C.Workstations, notebooks, and point-of-sale systems.
D.Lifecycle auditing of incidents, from assignment to resolution.

正解:
Explanation:
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/EndpointProtectionDomaindashboards

Question No : 15
The Add-On Builder creates Splunk Apps that start with what?

A.DA
B.SA
C.TA
D.App-

正解:
Explanation:
Reference: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/abouttheessolution/

Splunk SPLK-3001 問題練習