Splunk Enterprise Security Admin (SPLK-3001) Certification Sample Questions

02. What does threat intelligence matching compare the loaded indicators against?
a) The normalized fields the data models carry, such as the addresses, domains and file hashes in the events
b) The raw text of every event as it arrives, so that an indicator is found wherever it happens to appear
c) The asset and identity lists, so that any of the organization's own machines and accounts named in a feed are flagged
d) The notable events already created, so that findings can be reassessed against indicators loaded afterwards

03. Analysts report that notable events from one correlation search consistently arrive at a lower urgency than the activity deserves. What does the administrator change?
a) The adaptive response actions on the search, so the notable is created after the enrichment runs.
b) The urgency recorded on the correlation search, so that every notable it creates arrives higher.
c) The search's severity, or the priority on the assets and identities involved.
d) The disposition applied to those notables in Incident Review, which lifts them in the queue.

04. Where does the content of the ES asset and identity lists come from?
a) From the threat intelligence feeds, which supply the categories and the priorities that the two lists carry
b) From lookup lists that an ES administrator configures and merges, drawn from the sources of record the organization already keeps
c) From the technology add-ons, each of which registers the hosts and the accounts that appear in the source it normalizes
d) From the events themselves, since ES adds a record the first time it observes a host or an account it has not seen before

05. Creating a notable event is the adaptive response an ES correlation search uses most often. What else can be configured as an adaptive response on that search?
a) Rebuilding the data model the search queries, so that the following run works from current summaries
b) Granting the analyst who receives the result the ES capability needed to work it
c) Sending a notification, running a script, or handing the finding off to another product for it to act on
d) Adjusting the search's own schedule when the rate at which it matches rises above what the analysts can absorb

06. Why does a correlation search that was well tuned at deployment need revisiting later?
a) Search performance degrades as the stored notable events accumulate, and reviewing the searches is how that growth is kept in check
b) The environment it matches against changes as hosts appear and are retired and business processes are altered, so what counted as unusual there no longer does
c) A search schedule drifts as the search head grows busier, so the intervals a search runs at have to be reset from time to time
d) Correlation searches lose their throttling settings whenever ES content is updated, and an administrator has to reapply them by hand afterwards, search by search

07. One analyst has to be able to edit correlation searches. Everything else about their access is correct, the team's other analysts must not gain that ability, and this analyst must gain no other Enterprise Security administration ability. How is that arranged?
a) Move that analyst to the Enterprise Security administrator role, which carries the ability.
b) Grant the ability on the platform role underneath, since Enterprise Security takes its permissions from there.
c) Add the capability to the analyst role, and remove it again once the work is finished.
d) Give that analyst an additional role carrying the capability, leaving the shared role unchanged.

08. Several correlation searches are set to run at the same point in every hour, and some of them are being skipped. What does staggering their schedules address?
a) They compete for the same search capacity at that moment, so spreading the start times lets each of them run
b) Their time ranges overlap, and separating the start times removes the duplicate results that overlap produces
c) They are querying an unaccelerated data model, and moving their start times later is what lets the acceleration catch up between runs
d) They are throttled against one another by default, and a shared schedule makes them suppress each other's notable events

09. A team proposes to work Enterprise Security from one shared login so that any of them can pick up whatever is outstanding. What does the administrator point out?
a) A shared account cannot be given an Enterprise Security role, because the roles are assigned per person.
b) The shared account would need every Enterprise Security capability, which cannot be granted at once.
c) Enterprise Security refuses a second session for an account already signed in.
d) Ownership of a notable event would record the shared account, so no one is accountable for it.

10. The same person appears in three sources as a Windows account, an email address and a short user name. What allows ES to treat all three as one person?
a) Each correlation search is written to match all three forms, so every search accounts for the variations itself
b) The asset list resolves the machine each event came from, and the person is inferred from who is assigned to it
c) The technology add-ons apply field aliases that rename each form to a single field, which makes the three values the same across every source
d) The identity record for that person lists the alternative forms of the account name, so an event carrying any of them resolves to it