SPLK-3001 Practice Test

SPLK-3001 Practice Test practice questions, page 2 of 4, with answer review and explanations.

Question 6

In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?

  1. Save the settings.
  2. Apply the correct tags.
  3. Run the correct search.
  4. Visit the CIM dashboard.

Question 7

What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?

  1. ess_user
  2. ess_admin
  3. ess_analyst
  4. ess_reviewer

Question 8

Which column in the Asset or Identity list is combined with event security to make a notable event's urgency?

  1. VIP
  2. Priority
  3. Importance
  4. Criticality

Question 9

What does the risk framework add to an object (user, server or other type) to indicate increased risk?

  1. An urgency.
  2. A risk profile.
  3. An aggregation.
  4. A numeric score.

Question 10

Which indexes are searched by default for CIM data models?

  1. notable and default
  2. summary and notable
  3. _internal and summary
  4. All indexes