EMT Practice Test

1. Question Content...

---

Question1: Which data model populated the panels on the Risk Analysis dashboard?

Question2: Analysts have requested the ability to capture and analyze network traffic dat a. The administrator has researched the documentation and, based on this research, has decided to integrate the Splunk App for Stream with ES.
Which dashboards will now be supported so analysts can view and analyze network Stream data?

Question3: Which of the following are data models used by ES? (Choose all that apply)

Question4: Following the Installation of ES, an admin configured Leers with the ss_uso r role the ability to close notable events. How would the admin restrict these users from being able to change the status of Resolved notable events to closed?

Question5: Where is it possible to export content, such as correlation searches, from ES?

Question6: Which of the following is a key feature of a glass table?

Question7: What is the first step when preparing to install ES?

Question8: In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?

Question9: Both "Recommended Actions" and "Adaptive Response Actions" use adaptive response. How do they differ?

Question10: Which correlation search feature is used to throttle the creation of notable events?

Question11: Which of the following is a risk of using the Auto Deployment feature of Distributed Configuration Management to distribute indexes.conf?

Question12: ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

Question13: Where is the Add-On Builder available from?

Question14: Which of the following ES features would a security analyst use while investigating a network anomaly notable?

Question15: Where are attachments to investigations stored?

Question16: After installing Enterprise Security, the distributed configuration management tool can be used to create which app to configure indexers?

Question17: A security manager has been working with the executive team en long-range security goals. A primary goal for the team Is to Improve managing user risk in the organization. Which of the following ES features can help identify users accessing inappropriate web sites?

Question18: Which of the following threat intelligence types can ES download? (Choose all that apply)

Question19: What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

Question20: What feature of Enterprise Security downloads threat intelligence data from a web server?

Question21: What is an example of an ES asset?

Question22: Which of the following steps will make the Threat Activity dashboard the default landing page in ES?

Question23: Where should an ES search head be installed?

Question24: How is it possible to specify an alternate location for accelerated storage?

Question25: Enterprise Security's dashboards primarily pull data from what type of knowledge object?

Question26: ES needs to be installed on a search head with which of the following options?

Question27: An administrator is provisioning one search head prior to installing ES. What are the reference minimum requirements for OS, CPU, and RAM for that machine?

Question28: Which feature contains scenarios that are useful during ES Implementation?

Question29: When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?