Deck 6: Splunk IT Service Intelligence Certified Admin

Question 1

How is it possible to navigate to the list of currently-enabled ES correlation searches?

A) Configure -> Correlation Searches -> Select Status "Enabled"
B) Settings -> Searches, Reports, and Alerts -> Filter by Name of "Correlation"
C) Configure -> Content Management -> Select Type "Correlation" and Status "Enabled"
D) Settings -> Searches, Reports, and Alerts -> Select App of "SplunkEnterpriseSecuritySuite" and filter by "-Rule"

Answer 1

A

Question 2

How is notable event urgency calculated?

A) Asset priority and threat weight.
B) Alert severity found by the correlation search.
C) Asset or identity risk and severity found by the correlation search.
D) Severity set by the correlation search and priority assigned to the associated asset or identity.

Answer 2

D

Question 3

What feature of Enterprise Security downloads threat intelligence data from a web server?

A) Threat Service Manager
B) Threat Download Manager
C) Threat Intelligence Parser
D) Threat Intelligence Enforcement

Answer 3

B

Question 4

Which of the following threat intelligence types can ES download? (Choose all that apply.)

A) Text
B) STIX/TAXII
C) VulnScanSPL
D) SplunkEnterpriseThreatGenerator

Question 5

When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

A) $fieldname$
B) "fieldname"
C) %fieldname%
D) _fieldname_

Question 6

Which of the following are data models used by ES? (Choose all that apply.)

A) Web
B) Anomalies
C) Authentication
D) Network Traffic

Question 7

Which column in the Asset or Identity list is combined with event security to make a notable event's urgency?

A) VIP
B) Priority
C) Importance
D) Criticality

Question 8

At what point in the ES installation process should Splunk_TA_ForIndexers.spl be deployed to the indexers?

A) When adding apps to the deployment server.
B) Splunk_TA_ForIndexers.spl is installed first. is installed first.
C) After installing ES on the search head(s) and running the distributed configuration management tool.
D) Splunk_TA_ForIndexers.spl is only installed on indexer cluster sites using the cluster master and the splunk apply cluster-bundle command. Splunk_TA_ForIndexers.spl is only installed on indexer cluster sites using the cluster master and the splunk apply cluster-bundle command.

Question 9

The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data. What data model should be checked for potential errors such as skipped searches?

A) Web
B) Risk
C) Performance
D) Authentication

Question 10

Where is the Add-On Builder available from?

A) GitHub
B) SplunkBase
C) www.splunk.com
D) The ES installation package

Question 11

What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

A) Configure -> Incident Management -> Notable Event Statuses
B) Configure -> Content Management -> Type: Correlation Search
C) Configure -> Incident Management -> Incident Review Settings -> Event Management
D) Configure -> Incident Management -> Incident Review Settings -> Table Attributes

Question 12

Which of the following are examples of sources for events in the endpoint security domain dashboards?

A) REST API invocations.
B) Investigation final results status.
C) Workstations, notebooks, and point-of-sale systems.
D) Lifecycle auditing of incidents, from assignment to resolution.

Question 13

The Add-On Builder creates Splunk Apps that start with what?

A) DA-
B) SA-
C) TA-
D) App-

Question 14

Which of the following would allow an add-on to be automatically imported into Splunk Enterprise Security?

A) A prefix of CIM_ A prefix of CIM_
B) A suffix of .spl A suffix of .spl
C) A prefix of TECH_ TECH_
D) A prefix of Splunk_TA_ Splunk_TA_

Question 15

In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?

A) Save the settings.
B) Apply the correct tags.
C) Run the correct search.
D) Visit the CIM dashboard.

Question 16

Which of the following is a key feature of a glass table?

A) Rigidity.
B) Customization.
C) Interactive investigations.
D) Strong data for later retrieval.

Question 17

Which argument to the | tstats command restricts the search to summarized data only?

A) summaries=t
B) summaries=all
C) summariesonly=t
D) summariesonly=all

Question 18

Which indexes are searched by default for CIM data models?

A) notable and default notable and default
B) summary and notable summary
C) _internal and summary _internal
D) All indexes

Question 19

Which setting is used in indexes.conf to specify alternate locations for accelerated storage?

A) thawedPath
B) tstatsHomePath
C) summaryHomePath
D) warmToColdScript

Question 20

What does the risk framework add to an object (user, server or other type) to indicate increased risk?

A) An urgency.
B) A risk profile.
C) An aggregation.
D) A numeric score.

Question 21

Which correlation search feature is used to throttle the creation of notable events?

A) Schedule priority.
B) Window interval.
C) Window duration.
D) Schedule windows.

Question 22

If a username does not match the 'identity' column in the identities list, which column is checked next?

A) Email.
B) Nickname
C) IP address.
D) Combination of Last Name, First Name.

Question 23

ES needs to be installed on a search head with which of the following options?

A) No other apps.
B) Any other apps installed.
C) All apps removed except for TA-*.
D) Only default built-in and CIM-compliant apps.

Question 24

After installing Enterprise Security, the distributed configuration management tool can be used to create which app to configure indexers?

A) Splunk_DS_ForIndexers.spl
B) Splunk_ES_ForIndexers.spl
C) Splunk_SA_ForIndexers.spl
D) Splunk_TA_ForIndexers.spl

Question 25

When investigating, what is the best way to store a newly-found IOC?

A) Paste it into Notepad.
B) Click the "Add IOC" button.
C) Click the "Add Artifact" button.
D) Add it in a text note to the investigation.

Question 26

Which of the following ES features would a security analyst use while investigating a network anomaly notable?

A) Correlation editor.
B) Key indicator search.
C) Threat download dashboard.
D) Protocol intelligence dashboard.

Question 27

Where are attachments to investigations stored?

A) KV Store
B) notable index notable index
C) attachments.csv lookup attachments.csv lookup
D) /etc/apps/SA-Investigations/default/ui/views/attachments

Question 28

How should an administrator add a new lookup through the ES app?

A) Upload the lookup file in Settings -> Lookups -> Lookup Definitions
B) Upload the lookup file in Settings -> Lookups -> Lookup table files
C) Add the lookup file to /etc/apps/SplunkEnterpriseSecuritySuite/lookups Add the lookup file to /etc/apps/SplunkEnterpriseSecuritySuite/lookups
D) Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup

Question 29

A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?

A) Install ES on the existing search head.
B) Add a new search head and install ES on it.
C) Increase the number of CPUs and amount of memory on the search head, then install ES.
D) Delete the non-CIM-compliant apps from the search head, then install ES.

Question 30

What feature of Enterprise Security downloads threat intelligence data from a web server?

A) Threat Service Manager
B) Threat Download Manager
C) Threat Intelligence Parser
D) Therat Intelligence Enforcement

Question 31

An administrator is provisioning one search head prior to installing ES. What are the reference minimum requirements for OS, CPU, and RAM for that machine?

A) OS: 32 bit, RAM: 16 MB, CPU: 12 cores
B) OS: 64 bit, RAM: 32 MB, CPU: 12 cores
C) OS: 64 bit, RAM: 12 MB, CPU: 16 cores
D) OS: 64 bit, RAM: 32 MB, CPU: 16 cores

Question 32

When ES content is exported, an app with a .spl extension is automatically created. What is the best practice when exporting and importing updates to ES content?

A) Use new app names each time content is exported.
B) Do not use the .spl extension when naming an export. Do not use the extension when naming an export.
C) Always include existing and new content for each export.
D) Either use new app names or always include both existing and new content.

Question 33

Who can delete an investigation?

A) ess_admin users only.
B) The investigation owner only.
C) The investigation owner and ess-admin.
D) The investigation owner and collaborators.

Question 34

What is the default schedule for accelerating ES Datamodels?

A) 1 minute
B) 5 minutes
C) 15 minutes
D) 1 hour

Question 35

Which settings indicates that the correlation search will be executed as new events are indexed?

A) Always-On
B) Real-Time
C) Scheduled
D) Continuous

Question 36

Enterprise Security's dashboards primarily pull data from what type of knowledge object?

A) Tstats
B) KV Store
C) Data models
D) Dynamic lookups

Question 37

An administrator wants to ensure that none of the ES indexed data could be compromised through tampering. What feature would satisfy this requirement?

A) Index consistency.
B) Data integrity control.
C) Indexer acknowledgement.
D) Index access permissions.

Question 38

Which of the following features can the Add-on Builder configure in a new add-on?

A) Expire data.
B) Normalize data.
C) Summarize data.
D) Translate data.

Question 39

What is the first step when preparing to install ES?

A) Install ES.
B) Determine the data sources used.
C) Determine the hardware required.
D) Determine the size and scope of installation.

Question 40

How is it possible to navigate to the ES graphical Navigation Bar editor?

A) Configure -> Navigation Menu
B) Configure -> General -> Navigation
C) Settings -> User Interface -> Navigation -> Click on "Enterprise Security"
D) Settings -> User Interface -> Navigation Menus -> Click on "default" next to SplunkEnterpriseSecuritySuite

Question 41

What is the maximum recommended volume of indexing per day, per indexer, for a non-cloud (on-prem) ES deployment?

A) 50 GB
B) 100 GB
C) 300 GB
D) 500 MB

Question 42

What should be used to map a non-standard field name to a CIM field name?

A) Field alias.
B) Search time extraction.
C) Tag.
D) Eventtype.

Question 43

Which of the following actions may be necessary before installing ES?

A) Add additional indexers.
B) Redirect distributed search connections.
C) Purge KV Store.
D) Add additional forwarders.

Question 44

The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated. How can the correlation search be made less sensitive?

A) Edit the search and modify the notable event status field to make the notable events less urgent.
B) Edit the search, look for where or xswhere statements, and after the threshold value being compared to make it less common match.
C) Edit the search, look for where or xswhere statements, and alter the threshold value being compared to make it a more common match.
D) Modify the urgency table for this correlation search and add a new severity level to make notable events from this search less urgent.

Question 45

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives. Which of the following options is most likely to help performance?

A) Change the search heads to do local indexing of summary searches.
B) Add heavy forwarders between the universal forwarders and indexers so inputs can be parsed before indexing.
C) Increase memory and CPUs on the search head(s) and add additional indexers.
D) If indexed realtime search is enabled, disable it for the notable index.

Question 46

When installing Enterprise Security, what should be done after installing the add-ons necessary for normalizing data?

A) Nothing, there are no additional steps for add-ons.
B) Configure the add-ons via the Content Management dashboard.
C) Disable the add-ons until they are ready to be used, then enable the add-ons.
D) Configure the add-ons according to their README or documentation.

Question 47

Which of the following actions can improve overall search performance?

A) Disable indexed real-time search.
B) Increase priority of all correlation searches.
C) Reduce the frequency (schedule) of lower-priority correlation searches.
D) Add notable event suppressions for correlation searches with high numbers of false positives.

Question 48

An administrator is asked to configure an "Nslookup" adaptive response action, so that it appears as a selectable option in the notable event's action menu when an analyst is working in the Incident Review dashboard. What steps would the administrator take to configure this option?

A) Configure -> Content Management -> Type: Correlation Search -> Notable -> Nslookup
B) Configure -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup
C) Configure -> Content Management -> Type: Correlation Search -> Notable -> Next Steps -> Nslookup
D) Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

Question 49

Which of the following actions would not reduce the number of false positives from a correlation search?

A) Reducing the severity.
B) Removing throttling fields.
C) Increasing the throttling window.
D) Increasing threshold sensitivity.

Question 50

Which of the following is a risk of using the Auto Deployment feature of Distributed Configuration Management to distribute indexes.conf ?

A) Indexers might crash.
B) Indexers might be processing.
C) Indexers might not be reachable.
D) Indexers have different settings.

Question 51

What does the Security Posture dashboard display?

A) Active investigations and their status.
B) A high-level overview of notable events.
C) Current threats being tracked by the SOC.
D) A display of the status of security tools.

Question 52

"10.22.63.159", "websvr4", and "00:26:08:18: CF:1D" would be matched against what in ES?

A) A user.
B) A device.
C) An asset.
D) An identity.

Question 53

Accelerated data requires approximately how many times the daily data volume of additional storage space per year?

A) 3.4
B) 5.7
C) 1.0
D) 2.5

Question 54

Which settings indicated that the correlation search will be executed as new events are indexed?

A) Always-On
B) Real-Time
C) Scheduled
D) Continuous

Question 55

What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?

A) ess_user
B) ess_admin
C) ess_analyst
D) ess_reviewer

Question 56

Which data model populates the panels on the Risk Analysis dashboard?

A) Risk
B) Audit
C) Domain analysis
D) Threat intelligence

Question 57

Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events. How would the admin restrict these users from being able to change the status of Resolved notable events to Closed ?

A) In Enterprise Security, give the ess_user role the Own Notable Events permission. In Enterprise Security, give the role the Own Notable Events permission.
B) From the Status Configuration window select the Closed status. Remove ess_user from the status transitions for the Resolved status. From the Status Configuration window select the status. Remove from the status transitions for the status.
C) From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the Closed status.
D) From Splunk Access Controls, select the ess_user role and remove the edit_notable_events capability. From Splunk Access Controls, select the role and remove the edit_notable_events capability.

Question 58

To observe what network services are in use in a network's activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?

A) Intrusion Center
B) Protocol Analysis
C) User Intelligence
D) Threat Intelligence

Question 59

Which component normalizes events?

A) SA-CIM.
B) SA-Notable.
C) ES application.
D) Technology add-on.

Question 60

Glass tables can display static images and text, the results of ad-hoc searches, and which of the following objects?

A) Lookup searches.
B) Summarized data.
C) Security metrics.
D) Metrics store searches.

Question 61

Which two fields combine to create the Urgency of a notable event?

A) Priority and Severity.
B) Priority and Criticality.
C) Criticality and Severity.
D) Precedence and Time.

Question 62

What do threat gen searches produce?

A) Threat correlation searches.
B) Threat intel in KV Store collections.
C) Events in the threat_activity index. Events in the threat_activity index.
D) Threat notables in the notable index. Threat notables in the notable

Question 63

What are adaptive responses triggered by?

A) By correlation searches and users on the incident review dashboard.
B) By correlation searches and custom tech add-ons.
C) By correlation searches and users on the threat analysis dashboard.
D) By custom tech add-ons and users on the risk analysis dashboard.

Question 64

Which of the following is a recommended pre-installation step?

A) Install the latest Python distribution on the search head.
B) Download the latest version of KV Store from MongoDB.com.
C) Configure search head forwarding.
D) Disable the default search app.

Question 65

The option to create a Short ID for a notable event is located where?

A) The Additional Fields.
B) The Event Details.
C) The Contributing Events.
D) The Description.

Question 66

What is the bar across the bottom of any ES window?

A) The Investigator Workbench.
B) The Investigation Bar.
C) The Compliance Bar.
D) The Analyst Bar.

Question 67

Which of the following is an adaptive action that is configured by default for ES?

A) Create new asset
B) Create notable event
C) Create investigation
D) Create new correlation search

Question 68

Which of the following steps will make the Threat Activity dashboard the default landing page in ES?

A) Edit the Threat Activity view settings and checkmark the Default View option.
B) From the Edit Navigation page, click the "Set this as the default view" checkmark for Threat Activity.
C) From the Edit Navigation page, drag and drop the Threat Activity view to the top of the page.
D) From the Preferences menu for the user, select Enterprise Security as the default application.

Question 69

A set of correlation searches are enabled at a new ES installation, and results are being monitored. One of the correlation searches is generating many notable events which, when evaluated, are determined to be false positives. What is a solution for this issue?

A) Suppress notable events from that correlation search.
B) Disable acceleration for the correlation search to reduce storage requirements.
C) Modify the correlation schedule and sensitivity for your site.
D) Change the correlation search's default status and severity.

Question 70

When using distributed configuration management to create the Splunk_TA_ForIndexers package, which three files can be included?

A) indexes.conf, props.conf, transforms.conf
B) web.conf, props.conf, transforms.conf
C) inputs.conf, props.conf, transforms.conf
D) eventtypes.conf, indexes.conf, tags.conf

Question 71

A newly built custom dashboard needs to be available to a team of security analysts in ES. How is it possible to integrate the new dashboard?

A) Set the dashboard permissions to allow access by es_analysts and use the navigation editor to add it to the menu.
B) Add the dashboard to a custom add-in app and install it to ES using the Content Manager.
C) Add links on the ES home page to the new dashboard.
D) Create a new role inherited from es_analyst, make the dashboard permissions read-only, and make this dashboard the default view for the new role.

Question 72

What does the summariesonly=true option do for a correlation search?

A) Searches only accelerated data.
B) Forwards summary indexes to the indexing tier.
C) Uses a default summary time range.
D) Searches summary indexes only.