Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

ag-Splunk ES > Practice Test 1 > Flashcards

Practice Test 1 Flashcards

1
Q

The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data.
What data model should be checked for potential errors such as skipped searches?

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?

A

Run the correct search.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?

A

ess_analyst

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which column in the Asset or Identity list is combined with event security to make a notable event’s urgency?

A

Priority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

The Add-On Builder creates Splunk Apps that start with what?

A

TA-

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which of the following are examples of sources for events in the endpoint security domain dashboards?

A

Workstations, notebooks, and point-of-sale systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

A

$fieldname$

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What feature of Enterprise Security downloads threat intelligence data from a web server?

A

Threat Download Manager

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does the risk framework add to an object (user, server or other type) to indicate increased risk?

A

A risk score.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which indexes are searched by default for CIM data models?

A

All indexes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Which setting is used in indexes.conf to specify alternate locations for accelerated storage?

A

tstatsHomePath

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Which of the following is a way to test for a property normalized data model?

A

Run a | datamodel search, compare results to the CIM documentation for the datamodel.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Which argument to the | tstats command restricts the search to summarized data only?

A

summariesonly=t

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

When investigating, what is the best way to store a newly-found IOC?

A

Click the Add Artifact.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How is it possible to navigate to the list of currently-enabled ES correlation searches?

A

Configure -> Content Management -> Select Type Correlation and Status Enabled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which of the following is a risk of using the Auto Deployment feature of Distributed Configuration Management to distribute indexes.conf?

A

Indexers have different settings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Which of the following are data models used by ES? (Choose all that apply.)

A

Web,Authentication, and Network Traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

At what point in the ES installation process should Splunk_TA_ForIndexers.spl be deployed to the indexers?

A

After installing ES on the search head(s) and running the distributed configuration management tool.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which correlation search feature is used to throttle the creation of notable events?

A

Window duration.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Both Recommended Actions and Adaptive Response Actions use adaptive response. How do they differ?

A

Recommended Actions show a list of Adaptive Responses to an analyst, Adaptive Response Actions run automatically without analyst intervention.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does the Security Posture dashboard display?

A

A high-level overview of notable events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

10.22.63.159, websvr4, and 00:26:08:18: CF:1D would be matched against what in ES?

A

An asset.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How should an administrator add a new lookup through the ES app?

A

Upload the lookup file using Configure -> Content Management -> Create New Content -> Managed Lookup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Glass tables can display static images and text, the results of ad-hoc searches, and which of the following objects?

A

Security metrics.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which of the following is a key feature of a glass table?

A

Customization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

An administrator is asked to configure an Nslookup adaptive response action, so that it appears as a selectable option in the notable event’s action menu when an analyst is working in the Incident Review dashboard.
What steps would the administrator take to configure this option?

A

Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

A

Configure -> Incident Management -> Incident Review Settings -> Table Attributes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

To observe what network services are in use in a network’s activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?

A

Intrusion Center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Adaptive response action history is stored in which index?

A

cim_modactions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Which of the following actions would not reduce the number of false positives from a correlation search?

A

Reducing the severity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Where is the Add-On Builder available from?

A

SplunkBase

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which of the following would allow an add-on to be automatically imported into Splunk Enterprise Security?

A

A prefix of Splunk_TA_

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

A

$SPLUNK_HOME/etc/shcluster/apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

How is notable event urgency calculated?

A

Severity set by the correlation search and priority assigned to the associated asset or identity. If more than one is involved in a single notable, the one with the highest priority determines urgency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What kind of value is in the red box in this picture?

Next to IP in source

A

A risk score

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Where is it possible to export content, such as correlation searches, from ES?

A

Configure -> Content Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Which of the following threat intelligence types can ES download? (Choose all that apply.)

A

Text and STIX/TAXII

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance.
What is the best practice for installing ES?

A

Add a new search head and install ES on it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Enterprise Security’s dashboards primarily pull data from what type of knowledge object?

A

Data models

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

To which of the following should the ES application be uploaded?

A

The search head.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

If a username does not match the `˜identity’ column in the identities list, which column is checked next?

A

Email.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Which of the following features can the Add-on Builder configure in a new add-on?

A

Normalize data.
Built-in validation
Should not be used on prod servers
Custom data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is the maximum recommended volume of indexing per day, per indexer, for a non-cloud (on-prem) ES deployment?

A

100 GB Max

80 GB wile planning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

ES needs to be installed on a search head with which of the following options?

A

Only default built-in and CIM-compliant apps.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Which settings indicates that the correlation search will be executed as new events are indexed?

A

Real Time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Where are attachments to investigations stored?

A

KV Store

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Which data model populates the panels on the Risk Analysis dashboard?

A

Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

How is it possible to navigate to the ES graphical Navigation Bar editor?

A

Configure -> General -> Navigation

49
Q

An administrator is provisioning one search head prior to installing ES.
What are the reference minimum requirements for OS, CPU, and RAM for that machine?

A

OS: 64 bit, RAM: 32 GB, CPU: 16 cores

50
Q

What tools does the Risk Analysis dashboard provide?

A

A display of the highest risk assets and identities.

51
Q

When ES content is exported, an app with a .spl extension is automatically created.What is the best practice when exporting and importing updates to ES content?

A

Either use new app names or always include both existing and new content.

52
Q

Who can delete an investigation?

A

ess_admin users only.

53
Q

After installing Enterprise Security, the distributed configuration management tool can be used to create which app to configure indexers?

A

Splunk_TA_ForIndexers.spl

54
Q

The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated.
How can the correlation search be made less sensitive?

A

Edit the search, look for where or xswhere statements, and after the threshold value being compared to make it less common match.

55
Q

Which of the following actions can improve overall search performance?

A

Disable indexed real-time search.

56
Q

Which of the following ES features would a security analyst use while investigating a network anomaly notable?

A

Protocol intelligence dashboard.

57
Q

Which component normalizes events?

A

SA-CIM.

58
Q

An administrator wants to ensure that none of the ES indexed data could be compromised through tampering.
What feature would satisfy this requirement?

A

Data integrity control.

59
Q

What is the first step when preparing to install ES?

A

Determine the size and scope of installation.

60
Q

What is the default schedule for accelerating ES Datamodels?

A

5 minutes

61
Q

Accelerated data requires approximately how many times the daily data volume of additional storage space per year?

A

x3.4

62
Q

When installing Enterprise Security, what should be done after installing the add-ons necessary for normalizing data?

A

Configure the add-ons according to their README or documentation.

63
Q

What can be exported from ES using the Content Management page?

A

You can export any type of content on the Content Management page, such as correlation searches, data models, and views

64
Q

Where should an ES search head be installed?

A

On a server with a new install of Splunk.

65
Q

Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events.
How would the admin restrict these users from being able to change the status of Resolved notable events to Closed?

A

From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the Closed status.

66
Q

Which of the following actions may be necessary before installing ES?

A

Add additional indexers.

67
Q

A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.
Which of the following options is most likely to help performance?

A

Increase memory and CPUs on the search head(s) and add additional indexers.

68
Q

What should be used to map a non-standard field name to a CIM field name?

A

Field alias.

69
Q

Which of the following lookup types in Enterprise Security contains information about known hostile IP addresses?

A

Threat intel.

70
Q

A set of correlation searches are enabled at a new ES installation, and results are being monitored. One of the correlation searches is generating many notable events which, when evaluated, are determined to be false positives.
What is a solution for this issue?

A

Modify the correlation schedule and sensitivity for your site.

71
Q

Which of the following steps will make the Threat Activity dashboard the default landing page in ES?

A

From the Edit Navigation page, click the “Set this as the default view” checkmark for Threat Activity.

72
Q

When using distributed configuration management to create the Splunk_TA_ForIndexers package, which three files can be included?

A

indexes.conf, props.conf, transforms.conf

73
Q

Which feature contains scenarios that are useful during ES implementation?

A

Use Case Library

74
Q

Where is detailed information about identities stored?

A

The Identity Lookup CSV file.

75
Q

The option to create a Short ID for a notable event is located where?

A

The Event Details.

76
Q

A newly built custom dashboard needs to be available to a team of security analysts in ES.
How is it possible to integrate the new dashboard?

A

Set the dashboard permissions to allow access by es_analysts and use the navigation editor to add it to the menu.

77
Q

What is the bar across the bottom of any ES window?

A

The Investigation Bar.

78
Q

Which two fields combine to create the Urgency of a notable event?

A

Priority and Severity.

79
Q

What do threat gen searches produce?

A

Events in the threat_activity index.

80
Q

Check- Which of the following is part of tuning correlation searches for a new ES installation?

A

Configuring correlation adaptive responses.

81
Q

Which columns in the Assets lookup are used to identify an asset in an event?

A

ip, mac, dns, nt_host

82
Q

What does the summariesonly=true option do for a correlation search?

A

Searches only accelerated data.

83
Q

Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

A

SplunkWeb (8000), Splunk Management (8089), KV Store (8191)

84
Q

What is the main purpose of the Dashboard Requirements Matrix document?

A

Identifies on which data model(s) each dashboard depends.

85
Q

Which of the following is a recommended pre-installation step?

A

Configure search head forwarding.

86
Q

What are adaptive responses triggered by?

A

By correlation searches and users on the incident review dashboard.

87
Q

Which of the following is an adaptive action that is configured by default for ES?

A

Create notable event

88
Q

Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

A

SplunkWeb (8000), Splunk Management (8089), KV Store (8191)

89
Q

When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

A

$fieldname$

90
Q

When a correlation search detects an issue, it can initiate one or more.

A

Adaptive response actions

91
Q

The most common adaptive response action is?

A

To create a notable event

92
Q

Besides the most common adaptive response what are some other options?

A

-Adding risk objects
-Sending email
-Running a script
-Sending data to UBA
Ping or nslookup

93
Q

In the incident review dashboard adding multiple values per field are ____ together.

A

OR’d

94
Q

In the incident review dashboard urgency values can be _______.

A

toggled on and off

95
Q

In the incident review dashboard If values are set for more than one field they are _______ together.

A

AND’d

96
Q

ES Admins can define new status values and assign values to different rules.

A

Configure > Incident Management > Status Configuration

97
Q

Identities are?

A

people, identified by user name, email address, etc.

98
Q

ES Admins can configure an objects risk value?

A

Manually or by correlation search.

99
Q

Edit the risk analysis response action in a correlation search.

A

To modify the risk score that is assigned to an object.

100
Q

What ability would ess_analyst need to edit adaptive response action.

A

Edit correlation searches

101
Q

Adding ES to an existing site requires.

A

An extra search head and an additional indexers.

102
Q

The exact number of additional indexers ES needs depends on.

A

-Types and amounts of data being used
-Number of active correlation searches
-Number of real-time searches

103
Q

ES configures Splunk to use what type of searching.

A

Indexed real-time seach

104
Q

TA

A

Tech addon (input,normalization)

105
Q

DA

A

Domain addon (views, ui components)

106
Q

SA

A

Supporting addons (Searches, macros, data models, utilities)

107
Q

ES also installs

A

MTLK and UBA

108
Q

By default only users with ess_admin role can edit _____.

A

ES navigation

109
Q

Edit ES navigation can be given to ess_analyst and ess_user roles by who?

A

Admins

110
Q

Data models are

A

conceptual maps not containers

111
Q

Forwarder audit helps with

A

Ensures hosts are properly forwarding data to splunk

Detects forwarders that have failed

Can be set to monitor all hosts, or only hosts configured as is_expected in the ES assets look up table

112
Q

All correlation searches are

A

Disabled by default, enable only those that are needed.

113
Q

Scheduled correlation searches default to.

A

5 min

114
Q

Threshold

A

The criteria that causes a correlation search to trigger.

115
Q

Scheduling and throttling

A

How often to run the search and how often to generate notable events for the same type of events.

116
Q

Adaptive Responses

A

List of actions to take, including possibly creating a notable event or setting risk.

117
Q

Asset

A

Device

118
Q

Identity

A

Person

119
Q

Threat Intel

A

Locally produced and manged collections of treat intelligence

ag-Splunk ES (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions