Question 1

What is an example of an ES asset?

Options :

A : MAC address

B : User name

C : Server

D : People

Answer: A

Question 2

When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

Options :

A : $fieldname$

B : ''fieldname''

C : %fieldname%

D : _fieldname_

Answer: A

Question 3

When investigating, what is the best way to store a newly-found IOC?

Options :

A : Paste it into Notepad.

B : Click the ''Add IOC'' button.

C : Click the ''Add Artifact'' button.

D : Add it in a text note to the investigation.

Answer: B

Question 4

Which of the following ES features would a security analyst use while investigating a network anomaly notable?

Options :

A : Correlation editor.

B : Key indicator search.

C : Threat download dashboard.

D : Protocol intelligence dashboard.

Answer: D

Question 5

Where are attachments to investigations stored?

Options :

A : KV Store

B : notable index

C : attachments.csv lookup

D : <splunk_home>/etc/apps/SA-Investigations/default/ui/views/attachments

Answer: A

Free SPLK-3001 Mock Exam – Practice Online Confidently

Buying Options: