Free Splunk Enterprise Security Certified Admin Exam Practice Questions

A.  

Searches only accelerated data.

B.  

Forwards summary indexes to the indexing tier.

C.  

Uses a default summary time range.

D.  

Searches summary indexes only.

A.  

Install ES.

B.  

Determine the data sources used.

C.  

Determine the hardware required.

D.  

Determine the size and scope of installation.

A.  

Configure -> Content Management -> Type: Correlation Search -> Notable -> Nslookup

B.  

Configure -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

C.  

Configure -> Content Management -> Type: Correlation Search -> Notable -> Next Steps -> Nslookup

D.  

Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

A.  

summaries=t

B.  

summaries=all

C.  

summariesonly=t

D.  

summariesonly=all

A.  

3.4

B.  

5.7

C.  

1.0

D.  

2.5

A.  

Disable indexed real-time search.

B.  

Increase priority of all correlation searches.

C.  

Reduce the frequency (schedule) of lower-priority correlation searches.

D.  

Add notable event suppressions for correlation searches with high numbers of false positives.

A.  

A risk score.

B.  

A source ranking.

C.  

An event priority.

D.  

An IP address rating.

A.  

Threat Intel in KV Store collections.

B.  

Threat correlation searches.

C.  

Threat notables in the notable index.

D.  

Events in the threat_activity index.

A.  

Web and email domain names are set in General -> General Configuration.

B.  

ES uses the User Activity index and applies machine learning to determine internal and external domains.

C.  

The Corporate Web and Email Domain Lookups are edited during initial configuration.

D.  

ES extracts local email and web domains automatically from SMTP and HTTP logs.

A.  

Disable the default search app.

B.  

Configure search head forwarding.

C.  

Download the latest version of KV Store from MongoDBxom.

D.  

Install the latest Python distribution on the search head.