SPLK-3001 Practice Test

SPLK-3001 Practice Test practice questions, page 3 of 4, with answer review and explanations.

Question 11

Which setting is used in indexes.conf to specify alternate locations for accelerated storage?

  1. thawedPath
  2. tstatsHomePath
  3. summaryHomePath
  4. warmToColdScript

Question 12

Which of the following is a way to test for a property normalized data model?

  1. Use Audit -> Normalization Audit and check the Errors panel.
  2. Run a | datamodel search, compare results to the CIM documentation for the datamodel.
  3. Run a | loadjob search, look at tag values and compare them to known tags based on the encoding.
  4. Run a | datamodel search and compare the results to the list of data models in the ES normalization guide.

Question 13

Which argument to the | tstats command restricts the search to summarized data only?

  1. summaries=t
  2. summaries=all
  3. summariesonly=t
  4. summariesonly=all

Question 14

When investigating, what is the best way to store a newly-found IOC?

  1. Paste it into Notepad.
  2. Click the ג€Add IOCג€ button.
  3. Click the ג€Add Artifactג€ button.
  4. Add it in a text note to the investigation.

Question 15

How is it possible to navigate to the list of currently-enabled ES correlation searches?

  1. Configure -> Correlation Searches -> Select Status ג€Enabledג€
  2. Settings -> Searches, Reports, and Alerts -> Filter by Name of ג€Correlationג€
  3. Configure -> Content Management -> Select Type ג€Correlationג€ and Status ג€Enabledג€
  4. Settings -> Searches, Reports, and Alerts -> Select App of ג€SplunkEnterpriseSecuritySuiteג€ and filter by ג€-Ruleג€