Splunk SPLK-3001 - Splunk Enterprise Security Certified Admin Exam
Page: 2 / 20
Total 100 questions
Question #6 (Topic: Single Topic)
In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?
A. Save the settings.
B. Apply the correct tags.
C. Run the correct search.
D. Visit the CIM dashboard.
Answer: C
Question #7 (Topic: Single Topic)
What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?
A. ess_user
B. ess_admin
C. ess_analyst
D. ess_reviewer
Answer: B
Question #8 (Topic: Single Topic)
Which column in the Asset or Identity list is combined with event security to make a notable event's urgency?
A. VIP
B. Priority
C. Importance
D. Criticality
Answer: B
Question #9 (Topic: Single Topic)
What does the risk framework add to an object (user, server or other type) to indicate increased risk?
A. An urgency.
B. A risk profile.
C. An aggregation.
D. A numeric score.
Answer: C
Question #10 (Topic: Single Topic)
Which indexes are searched by default for CIM data models?
A. notable and default
B. summary and notable
C. _internal and summary
D. All indexes
Answer: D
