Splunk Enterprise Security Practice Test

These questions are part of the practice quiz. Start practicing

• Which aspect of security does role-based access control primarily focus on?
• After managing source types and extracting fields, which key step comes next in the Add-On Builder?
• What does the “risk scoring” feature do in Splunk ES?
• Which dashboards will be supported after integrating the Splunk App for Stream with ES?
• What is the primary purpose of the Incident Review Dashboard in Splunk ES?
• Which search language is used for querying data in Splunk Enterprise Security?
• At what point in the ES installation process should Splunk_TA_ForIndexers.spl be deployed to the indexers?
• What type of events would generally fall under high risk in the Risk Analysis dashboard?
• How would the admin restrict users with the ess_user role from being able to change the status of Resolved notable events to Closed?
• Which option allows for the configuration of a notable event's action menu in ES?
• What strategic advantage do compliance reports provide to organizations?
• What are the default ports required for Splunk Enterprise Security to function properly?
• What does the Security Posture dashboard display regarding notable events?
• To observe what network services are in use in a network's activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?
• How does Splunk ES handle data normalization?
• What should be used to map a non-standard field name to a CIM field name?
• How does ES know local customer domain names so it can detect internal vs. external emails?
• How does the correlation search feature function in Splunk ES?
• What is a 'sourcetype' in the context of Splunk data ingestion?
• What is the primary role of notable events in Splunk Enterprise Security?
• What is the purpose of the “Threat Hunt” feature in Splunk ES?
• How can security teams utilize dashboards in Splunk ES?
• What role do dashboards play in Splunk ES for incident management?
• In the context of security metrics, why are KPIs important?
• What is "event prioritization" in Splunk ES?
• In the context of notable events in Splunk ES, what does a "warning" status indicate?
• What should be done after installing the necessary add-ons for normalizing data in Enterprise Security?
• What steps must an administrator take to configure the "Nslookup" adaptive response action?
• To which of the following should the ES application be uploaded?
• Where can content such as correlation searches be exported from ES?
• How can Splunk's Machine Learning Toolkit enhance security operations?
• What allows an add-on to be automatically imported into Splunk Enterprise Security?
• What is the primary purpose of the Security Posture dashboard in Splunk ES?
• What is Splunk Enterprise Security primarily used for?
• What does the Risk Analysis dashboard provide?
• What is a requirement for installing Enterprise Security on a search head?
• What can be done to improve the performance of correlation searches?
• What is the primary difference between real-time and historical search in Splunk ES?
• Where are attachments to investigations stored?
• Which is an adaptive action that is configured by default for Enterprise Security?
• What is the first step when preparing to install ES?
• Why is the Cyber Kill Chain framework used in Splunk ES?
• What is an "user session" in Splunk ES?
• How does Splunk ES facilitate forensic analysis?
• Which ES feature can assist in identifying users accessing inappropriate websites?
• What may be a necessary action before installing Enterprise Security?
• How can a newly built custom dashboard be integrated into ES for security analysts?
• What does applying tags to data help achieve in Splunk ES?
• What does the Incident Review dashboard provide analysts in Splunk ES?
• What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?
• Both "Recommended Actions" and "Adaptive Response Actions" use adaptive response. How do they differ?
• What does the term "false positive" refer to in security alerts?
• What kind of value is represented in a blue box indicating an event priority?
• What are adaptive responses triggered by?
• What does a "false negative" indicate in security monitoring?
• What is the maximum recommended volume of indexing per day, per indexer, for a non-cloud (on-prem) ES deployment?
• How does Splunk ES leverage dashboards for proactive monitoring?
• How does Splunk Enterprise Security facilitate threat intelligence sharing?
• When creating the Splunk_TA_ForIndexers package, which files can be included using distributed configuration management?
• Which lookup type in Enterprise Security contains information about known hostile IP addresses?
• Which tool is used to update indexers in ES?
• Which of the following actions would not reduce the number of false positives from a correlation search?
• Glass tables can display static images and text, the results of ad-hoc searches, and which of the following objects?
• What is a potential risk associated with using the Auto Deployment feature of Distributed Configuration Management for indexes.conf?
• What is the best way to store a newly-found IOC when investigating?
• Which argument to the | tstats command restricts the search to summarized data only?
• What is the primary focus of correlation and alerting?
• What is the default schedule for accelerating ES Datamodels?
• What is essential to ensure raw data can be accelerated by a Data Model after ingestion?
• Enterprise Security's dashboards primarily pull data from what type of knowledge object?
• Which of the following is a recommended pre-installation step?
• Which lookup table does the Default Account Activity Detected correlation search use to flag known default accounts?
• How is notable event urgency calculated?
• Where can you find the option to create a Short ID for a notable event?
• Which of the following features can the Add-on Builder configure in a new add-on?
• Which Splunk feature helps in gathering threat intelligence for security analysis?
• What is the primary role of the Data Model in Splunk?
• Which correlation search feature is used to throttle the creation of notable events?
• Which columns in the Assets lookup are used to identify an asset in an event?
• Which of the following statements best describes SIEM functionality?
• What is notable about the Splunk ES app in terms of algorithms?
• What is the significance of “assets and identities” within Splunk ES?
• What is the significance of "data ingestion" in Splunk ES?
• How much additional storage space is approximately required per year for accelerated data relative to daily data volume?
• Which component enables integration with third-party security tools in Splunk ES?
• Which aspect of Splunk ES do assets and identities directly enhance?
• What feature in ES includes scenarios helpful during implementation?
• Which of the following actions can improve overall search performance?
• How do notifications function within Splunk ES?
• Which of the following is a Web Intelligence dashboard?
• What security framework provides a structure for designing security programs within Splunk ES?
• The Add-On Builder creates Splunk Apps that start with what?
• What do threat gen searches produce?
• Which indexes are searched by default for CIM data models in Splunk?
• What does the term "KPI" refer to in the context of security metrics?
• What is an example of an asset within Enterprise Security?
• In the context of Splunk ES, what does the analysis of incident response metrics contribute to?
• How can an alternate location for accelerated storage be specified?
• How are incident response metrics utilized in Splunk ES?
• What does the bar located at the bottom of any ES window represent?
• Which of the following is an example of a data model used for normalizing security events in Splunk?
• Adaptive response action history is stored in which index?
• What feature allows for maintaining the integrity of the indexed data in Splunk Enterprise Security?
• What is the objective of compliance reports in Splunk ES?
• What is the purpose of the Splunk App called "ES"?
• Which data model populated the panels on the Risk Analysis dashboard?
• What is one way to reduce false positives from the Brute Force Access Behavior Detected correlation search?
• Why is understanding the threat landscape crucial for security teams in Splunk ES?
• Which setting is used in indexes.conf to specify alternate locations for accelerated storage?
• Which option correctly describes the purpose of a correlation editor in ES?
• A customer site is experiencing poor performance. Which of the following options is most likely to help performance?
• Which of the following is a benefit of user session tracking in Splunk ES?
• How does the "SIEM" functionality in Splunk ES differ from standard logging?
• Which feature of Enterprise Security downloads threat intelligence data from a web server?
• In the context of Splunk ES, what does the term "notable event" refer to?
• Why is role-based access control significant in Splunk ES?
• Which data model should be checked for errors if the Remote Access panel is not populating with recent data?
• How can associations and dependencies be viewed within Splunk ES?
• What does the ess_user role allow a user to do within the Splunk ES environment?
• After installing Enterprise Security, which app can be used to configure indexers?
• How can one navigate to the ES graphical Navigation Bar editor?
• A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. The customer wants good ES performance while controlling costs. What is the best practice for installing ES?
• What is the purpose of incident response playbooks in Splunk ES?
• What is the importance of the "Splunk App for Enterprise Security"?
• Which column in the Asset or Identity list contributes to determining a notable event's urgency?
• Which two fields combine to create the Urgency of a notable event?
• What does "correlation and alerting" mean in Splunk ES?
• Which of the following is a way to test for a property normalized data model?
• Which of the following is a key feature of a glass table?
• When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?
• In the context of ES, what does a risk profile represent?
• If a username does not match the 'identity' column in the identities list, which column is checked next?
• Which module in Splunk ES is designed to assist with compliance and auditing?
• What is the main purpose of conducting a "risk assessment"?
• What are accelerated data models utilized for in Splunk ES?
• What overall benefit do saved searches offer to security analysts in Splunk ES?
• Which type of data visualization is most effective in identifying patterns in security incidents?
• What is the main purpose of the Dashboard Requirements Matrix document?
• What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?
• Which app is essential for integration with SIEM use cases in Splunk?
• What action should be taken if errors are suspected in a data model?
• An administrator wants to ensure that none of the ES indexed data could be compromised through tampering. What feature would satisfy this requirement?
• ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied to which location on the cluster deployer instance?
• How does data ingestion affect analytics in Splunk ES?
• Which license model does Splunk Enterprise Security generally use?
• What is "drilldown" functionality in Splunk dashboards?
• Which settings indicate that the correlation search will run as new events are indexed?
• What role do playbooks play in incident response?
• What is a solution if a correlation search is generating many false positive notable events?
• Which event type is used to classify notable events in Splunk ES?
• Where is it recommended to install an ES search head?
• What is the next step after extracting the correct fields in order to include an event type in a data model node?
• What does the risk framework add to an object to indicate increased risk?
• What kind of data sources does Splunk Enterprise Security utilize?
• Which type of data might be modeled under the Performance data model in ES?
• What is the primary function of the "Search Head" in Splunk architecture?
• What best practice should be followed when exporting and importing updates to ES content?
• How does the Incident Review dashboard benefit security operations in Splunk ES?
• What are examples of sources for events in the endpoint security domain dashboards?
• Which of the following steps will make the Threat Activity dashboard the default landing page in ES?
• What is a primary goal of threat intelligence in Splunk ES?
• If an admin wants to restrict ess_user role from changing Resolved notable events to closed, what is the recommended approach?
• An administrator is provisioning one search head prior to installing ES. What are the reference minimum requirements for OS, CPU, and RAM for that machine?
• What is the benefit of scheduled searches in security operations within Splunk ES?
• Which visualization technique is recommended for tracking changes in incident occurrences over time?
• What advantage does real-time search offer in Splunk ES?
• What is a key component of effective incident management in Splunk ES?
• Which feature in Splunk ES visualizes attack paths?
• Which ES feature would a security analyst use while investigating a network anomaly?
• How should an administrator add a new lookup through the ES app?
• What does the summariesonly=true option accomplish for a correlation search?
• What are performance benchmarks used for in Splunk ES?
• What can be exported from ES using the Content Management page?
• What does the term "threat landscape" refer to in the context of Splunk Enterprise Security?
• What types of alerts can configuration in Splunk ES trigger?
• Where is detailed information about identities stored in Splunk?
• What are data models used for in Splunk Enterprise Security?
• Which underlying platform does Splunk Enterprise Security run on?
• Where can the Add-On Builder be accessed from?
• Who can delete an investigation?
• What visualization tools does Splunk ES provide for data analysis?
• What does "CIM" stand for in the context of Splunk?
• What is the role of the Adaptive Response framework in Splunk ES?
• Which configuration file is associated with updating the Splunk indexers?
• What would "10.22.63.159", "websvr4", and "00:26:08:18:CF:1D" be matched against in Enterprise Security?
• Which of these is a benefit of data normalization?
• What is typically the outcome of utilizing the Compliance Module in Splunk ES?
• Which component is responsible for normalizing events?
• Which of the following is part of tuning correlation searches for a new ES installation?
• What role do "saved searches" have in Splunk ES?
• How is it possible to navigate to the list of currently-enabled ES correlation searches?
• What does analyzing security incidents help organizations to do?