最新的Splunk SPLK-3001免費考試真題

問題1

Which of the following is a recommended pre-installation step?

A. Disable the default search app.

B. Configure search head forwarding.

C. Install the latest Python distribution on the search head.

D. Download the latest version of KV Store from MongoDB.com.

正確答案: B

說明：（僅 Fast2test 成員可見）

問題2

What should be used to map a non-standard field name to a CIM field name?

A. Eventtype.

B. Search time extraction.

C. Field alias.

D. Tag.

正確答案: C

說明：（僅 Fast2test 成員可見）

問題3

When installing Enterprise Security, what should be done after installing the add-ons necessary for normalizing data?

A. Configure the add-ons via the Content Management dashboard.

B. Configure the add-ons according to their README or documentation.

C. Disable the add-ons until they are ready to be used, then enable the add-ons.

D. Nothing, there are no additional steps for add-ons.

正確答案: B

說明：（僅 Fast2test 成員可見）

問題4

Which of the following is a way to test for a property normalized data model?

A. Run a | loadjob search, look at tag values and compare them to known tags based on the encoding.

B. Use Audit -> Normalization Audit and check the Errors panel.

C. Run a | datamodel search, compare results to the CIM documentation for the datamodel.

D. Run a | datamodel search and compare the results to the list of data models in the ES normalization guide.

正確答案: C

問題5

To observe what network services are in use in a network's activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?

A. Threat Intelligence

B. User Intelligence

C. Intrusion Center

D. Protocol Analysis

正確答案: D

說明：（僅 Fast2test 成員可見）

問題6

Which correlation search feature is used to throttle the creation of notable events?

A. Schedule window.

B. Window duration.

C. Schedule priority.

D. Window interval.

正確答案: B

說明：（僅 Fast2test 成員可見）

問題7

Enterprise Security's dashboards primarily pull data from what type of knowledge object?

A. Tstats

B. Data models

C. Dynamic lookups

D. KV Store

正確答案: B

說明：（僅 Fast2test 成員可見）

問題8

What can be exported from ES using the Content Management page?

A. Only correlation searches, glass tables, and workbench panels.

B. Only correlation searches.

C. Any content type listed in the Content Management page.

D. Only correlation searches, managed lookups, and glass tables.

正確答案: C

說明：（僅 Fast2test 成員可見）

問題9

What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

A. Configure -> Incident Management -> Incident Review Settings -> Table Attributes

B. Configure -> Incident Management -> Notable Event Statuses

C. Configure -> Content Management -> Type: Correlation Search

D. Configure -> Incident Management -> Incident Review Settings -> Event Management

正確答案: A

說明：（僅 Fast2test 成員可見）

最新的Splunk Enterprise Security Certified Admin - SPLK-3001免費考試真題

聯系我們

站內鏈接

最新更新