Splunk ES Admin SPLK-3001 Practice Questions & Answers • ExamPrepare

Question 1

Where should an ES search head be installed?

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Which of the following steps will make the Threat Activity dashboard the default landing page in ES?

From the Edit Navigation page, click the "Set this as the default view" checkmark for Threat Activity.
From the Edit Navigation page, drag and drop the Threat Activity view to the top of the page.
From the Preferences menu for the user, select Enterprise Security as the default application.
Edit the Threat Activity view settings and checkmark the Default View option.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Which of the following is a risk of using the Auto Deployment feature of Distributed Configuration Management to distribute indexes.conf?

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Which of the following are data models used by ES? (select all that apply)

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

What is the bar across the bottom of any ES window?

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Which of the following actions would not reduce the number of false positives from a correlation search?

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.