SPLK-3001 Splunk Exam Questions and Free Practice Test

If a username does not match the ‘identity’ column in the identities list, which column is checked next?

A. Email.

B. Nickname

C. IP address.

D. Combination of Last Name, First Name.

Correct Answer:C

Which of the following would allow an add-on to be automatically imported into Splunk Enterprise Security?

A. A prefix of CIM_

B. A suffix of .spl

C. A prefix of TECH_

D. A prefix of Splunk_TA_

Correct Answer:D
Reference: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/planintegrationes/

How is it possible to navigate to the list of currently-enabled ES correlation searches?

A. Configure -> Correlation Searches -> Select Status “Enabled”

B. Settings -> Searches, Reports, and Alerts -> Filter by Name of “Correlation”

C. Configure -> Content Management -> Select Type “Correlation” and Status “Enabled”

D. Settings -> Searches, Reports, and Alerts -> Select App of “SplunkEnterpriseSecuritySuite” and filter by “-Rule”

Correct Answer:A
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Listcorrelationsearches

What kind of value is in the red box in this picture?
SPLK-3001 dumps exhibit

A. A risk score.

B. A source ranking.

C. An event priority.

D. An IP address rating.

Correct Answer:C
Reference: https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/FormateventsforHTTPEventCollector

How should an administrator add a new lookup through the ES app?

A. Upload the lookup file in Settings -> Lookups -> Lookup Definitions

B. Upload the lookup file in Settings -> Lookups -> Lookup table files

C. Add the lookup file to /etc/apps/SplunkEnterpriseSecuritySuite/lookups

D. Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup

Correct Answer:D
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Createlookups

What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

A. Configure -> Incident Management -> Notable Event Statuses

B. Configure -> Content Management -> Type: Correlation Search

C. Configure -> Incident Management -> Incident Review Settings -> Event Management

D. Configure -> Incident Management -> Incident Review Settings -> Table Attributes

Correct Answer:C
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/Admin/Customizenotables

START SPLK-3001 EXAM