The Add-On Builder creates Splunk Apps that start with what?
#1
Answer: C✅ Correct❌ Incorrect
Which of the following are examples of sources for events in the endpoint security domain dashboards?
#2
Answer: C✅ Correct❌ Incorrect
When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?
#3
Answer: A✅ Correct❌ Incorrect
What feature of Enterprise Security downloads threat intelligence data from a web server?
#4
Answer: B✅ Correct❌ Incorrect
The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data.What data model should be checked for potential errors such as skipped searches?
#5
Answer: D✅ Correct❌ Incorrect
In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?
#6
Answer: C✅ Correct❌ Incorrect
What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?
#7
Answer: C✅ Correct❌ Incorrect
Which column in the Asset or Identity list is combined with event security to make a notable event's urgency?
#8
Answer: B✅ Correct❌ Incorrect
What does the risk framework add to an object (user, server or other type) to indicate increased risk?
#9
Answer: D✅ Correct❌ Incorrect
Which indexes are searched by default for CIM data models?
#10
Answer: D✅ Correct❌ Incorrect
Which setting is used in indexes.conf to specify alternate locations for accelerated storage?
#11
Answer: B✅ Correct❌ Incorrect
Which of the following is a way to test for a property normalized data model?
#12
Answer: B✅ Correct❌ Incorrect
Which argument to the | tstats command restricts the search to summarized data only?
#13
Answer: C✅ Correct❌ Incorrect
When investigating, what is the best way to store a newly-found IOC?
#14
Answer: B✅ Correct❌ Incorrect
How is it possible to navigate to the list of currently-enabled ES correlation searches?
#15
Answer: C✅ Correct❌ Incorrect
Which of the following is a risk of using the Auto Deployment feature of Distributed Configuration Management to distribute indexes.conf?
#16
Answer: D✅ Correct❌ Incorrect
Which of the following are data models used by ES?
#17
Answer: B✅ Correct❌ Incorrect
At what point in the ES installation process should Splunk_TA_ForIndexers.spl be deployed to the indexers?
#18
Answer: C✅ Correct❌ Incorrect
Which correlation search feature is used to throttle the creation of notable events?
#19
Answer: C✅ Correct❌ Incorrect
Both `Recommended Actions` and `Adaptive Response Actions` use adaptive response. How do they differ?
#20
Answer: D✅ Correct❌ Incorrect
What does the Security Posture dashboard display?
#21
Answer: B✅ Correct❌ Incorrect
`10.22.63.159`, `websvr4`, and `00:26:08:18: CF:1D` would be matched against what in ES?
#22
Answer: C✅ Correct❌ Incorrect
How should an administrator add a new lookup through the ES app?
#23
Answer: D✅ Correct❌ Incorrect
Glass tables can display static images and text, the results of ad-hoc searches, and which of the following objects?
#24
Answer: C✅ Correct❌ Incorrect
Which of the following is a key feature of a glass table?
#25
Answer: B✅ Correct❌ Incorrect
An administrator is asked to configure an `Nslookup` adaptive response action, so that it appears as a selectable option in the notable event's action menu when an analyst is working in the Incident Review dashboard.What steps would the administrator take to configure this option?
#26
Answer: D✅ Correct❌ Incorrect
What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?
#27
Answer: D✅ Correct❌ Incorrect
To observe what network services are in use in a network's activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?
#28
Answer: B✅ Correct❌ Incorrect
Adaptive response action history is stored in which index?
#29
Answer: A✅ Correct❌ Incorrect
Which of the following actions would not reduce the number of false positives from a correlation search?