EMT Practice Test

1. Question Content...

---

Question1: Which data model populated the panels on the Risk Analysis dashboard?

Question2: Adaptive response action history is stored in which index?

Question3: An administrator is provisioning one search head prior to installing ES. What are the reference minimum requirements for OS, CPU, and RAM for that machine?

Question4: What is the main purpose of the Dashboard Requirements Matrix document?

Question5: Which column in the Asset or Identity list is combined with event security to make a notable event's urgency?

Question6: Which lookup table does the Default Account Activity Detected correlation search use to flag known default accounts?

Question7: What does the Security Posture dashboard display?

Question8: Where should an ES search head be installed?

Question9: What are adaptive responses triggered by?

Question10: To observe what network services are in use in a network's activity overall, which of the following dashboards in Enterprise Security will contain the most relevant data?

Question11: Which of the following is part of tuning correlation searches for a new ES installation?

Question12: The Remote Access panel within the User Activity dashboard is not populating with the most recent hour of data. What data model should be checked for potential errors such as skipped searches?

Question13: What is the maximum recommended volume of indexing per day, per indexer, for a non-cloud (on-prem) ES deployment?

Question14: If a username does not match the 'identity' column in the identities list, which column is checked next?

Question15: The Add-On Builder creates Splunk Apps that start with what?

Question16: What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

Question17: Which columns in the Assets lookup are used to identify an asset in an event?

Question18: A set of correlation searches are enabled at a new ES installation, and results are being monitored. One of the correlation searches is generating many notable events which, when evaluated, are determined to be false positives.
What is a solution for this issue?

Question19: Where is it possible to export content, such as correlation searches, from ES?

Question20: Which of the following actions can improve overall search performance?

Question21: Which of the following steps will make the Threat Activity dashboard the default landing page in ES?

Question22: How is notable event urgency calculated?

Question23: Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

Question24: ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

Question25: How is it possible to navigate to the list of currently-enabled ES correlation searches?

Question26: What is an example of an ES asset?

Question27: Glass tables can display static images and text, the results of ad-hoc searches, and which of the following objects?

Question28: Which of the following are data models used by ES? (Choose all that apply)

Question29: ES needs to be installed on a search head with which of the following options?

Question30: A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.
Which of the following options is most likely to help performance?

Question31: At what point in the ES installation process should Splunk_TA_ForIndexes.spl be deployed to the indexers?

Question32: Which of the following features can the Add-on Builder configure in a new add-on?

Question33: When using distributed configuration management to create the Splunk_TA_ForIndexers package, which three files can be included?

Question34: A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications.
All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?