EMT Practice Test

1. Question Content...

---

Question1: Which of the following is part of tuning correlation searches for a new ES installation?

Question2: How is it possible to specify an alternate location for accelerated storage?

Question3: A security manager has been working with the executive team en long-range security goals. A primary goal for the team Is to Improve managing user risk in the organization. Which of the following ES features can help identify users accessing inappropriate web sites?

Question4: Glass tables can display static images and text, the results of ad-hoc searches, and which of the following objects?

Question5: After data is ingested, which data management step is essential to ensure raw data can be accelerated by a Data Model and used by ES?

Question6: ES needs to be installed on a search head with which of the following options?

Question7: ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

Question8: Which of the following is a Web Intelligence dashboard?

Question9: A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.
Which of the following options is most likely to help performance?

Question10: Both "Recommended Actions" and "Adaptive Response Actions" use adaptive response. How do they differ?

Question11: Which of the following are data models used by ES? (Choose all that apply)

Question12: Which of the following is an adaptive action that is configured by default for ES?

Question13: What feature of Enterprise Security downloads threat intelligence data from a web server?

Question14: Where are attachments to investigations stored?

Question15: Which of the following is a recommended pre-installation step?

Question16: Which of the following are examples of sources for events in the endpoint security domain dashboards?

Question17: Which of the following is a key feature of a glass table?

Question18: In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?

Question19: Which column in the Asset or Identity list is combined with event security to make a notable event's urgency?

Question20: Which setting is used in indexes.conf to specify alternate locations for accelerated storage?

Question21: Which of the following actions may be necessary before installing ES?

Question22: What should be used to map a non-standard field name to a CIM field name?

Question23: The option to create a Short ID for a notable event is located where?

Question24: What are adaptive responses triggered by?

Question25: Analysts have requested the ability to capture and analyze network traffic dat a. The administrator has researched the documentation and, based on this research, has decided to integrate the Splunk App for Stream with ES.
Which dashboards will now be supported so analysts can view and analyze network Stream data?

Question26: When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event?

Question27: "10.22.63.159", "websvr4", and "00:26:08:18: CF:1D" would be matched against what in ES?

Question28: What is an example of an ES asset?

Question29: An administrator is asked to configure an "Nslookup" adaptive response action, so that it appears as a selectable option in the notable event's action menu when an analyst is working in the Incident Review dashboard. What steps would the administrator take to configure this option?

Question30: What tools does the Risk Analysis dashboard provide?

Question31: A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?

Question32: Where is detailed information about identities stored?