SPLK-3001 Practice Test

Review 100 SPLK-3001 practice questions with answer explanations and community insights.

Question 1

The Add-On Builder creates Splunk Apps that start with what?

  1. DA-
  2. SA-
  3. TA-
  4. App-

Question 2

Which of the following are examples of sources for events in the endpoint security domain dashboards?

  1. REST API invocations.
  2. Investigation final results status.
  3. Workstations, notebooks, and point-of-sale systems.
  4. Lifecycle auditing of incidents, from assignment to resolution.

Question 3

When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

  1. $fieldname$
  2. ג€fieldnameג€
  3. %fieldname%
  4. _fieldname_

Question 4

What feature of Enterprise Security downloads threat intelligence data from a web server?

  1. Threat Service Manager
  2. Threat Download Manager
  3. Threat Intelligence Parser
  4. Threat Intelligence Enforcement

Question 5

The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data. What data model should be checked for potential errors such as skipped searches?

  1. Web
  2. Risk
  3. Performance
  4. Authentication