EMT Practice Test

1. Question Content...

---

Question1: What is an example of an ES asset?

Question2: Where is the Add-On Builder available from?

Question3: Which of the following would allow an add-on to be automatically imported into Splunk Enterprise Security?

Question4: Which tool Is used to update indexers In E5?

Question5: When investigating, what is the best way to store a newly-found IOC?

Question6: Which of the following is part of tuning correlation searches for a new ES installation?

Question7: Where is it possible to export content, such as correlation searches, from ES?

Question8: Which of the following is a Web Intelligence dashboard?

Question9: What are the steps to add a new column to the Notable Event table in the Incident Review dashboard?

Question10: What should be used to map a non-standard field name to a CIM field name?

Question11: Which of the following is a key feature of a glass table?

Question12: What role should be assigned to a security team member who will be taking ownership of notable events in the incident review dashboard?

Question13: How does ES know local customer domain names so it can detect internal vs. external emails?

Question14: Which of the following ES features would a security analyst use while investigating a network anomaly notable?

Question15: When using distributed configuration management to create the Splunk_TA_ForIndexers package, which three files can be included?

Question16: When installing Enterprise Security, what should be done after installing the add-ons necessary for normalizing data?

Question17: Which of the following are examples of sources for events in the endpoint security domain dashboards?

Question18: What kind of value is in the red box in this picture?

Question19: Which feature contains scenarios that are useful during ES Implementation?

Question20: What is the main purpose of the Dashboard Requirements Matrix document?

Question21: A newly built custom dashboard needs to be available to a team of security analysts In ES. How is It possible to Integrate the new dashboard?

Question22: Which of the following steps will make the Threat Activity dashboard the default landing page in ES?

Question23: Which of the following is a risk of using the Auto Deployment feature of Distributed Configuration Management to distribute indexes.conf?

Question24: What is the maximum recommended volume of indexing per day, per indexer, for a non-cloud (on-prem) ES deployment?

Question25: An administrator is provisioning one search head prior to installing ES. What are the reference minimum requirements for OS, CPU, and RAM for that machine?

Question26: Which correlation search feature is used to throttle the creation of notable events?

Question27: Which of the following actions would not reduce the number of false positives from a correlation search?

Question28: Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

Question29: What feature of Enterprise Security downloads threat intelligence data from a web server?

Question30: Enterprise Security's dashboards primarily pull data from what type of knowledge object?

Question31: Which of the following actions can improve overall search performance?

Question32: How is notable event urgency calculated?

Question33: Which of the following actions can improve overall search performance?

Question34: What tools does the Risk Analysis dashboard provide?

Question35: What is the bar across the bottom of any ES window?

Question36: Who can delete an investigation?

Question37: Which of these Is a benefit of data normalization?

Question38: An administrator is asked to configure an "Nslookup" adaptive response action, so that it appears as a selectable option in the notable event's action menu when an analyst is working in the Incident Review dashboard. What steps would the administrator take to configure this option?

Question39: "10.22.63.159", "websvr4", and "00:26:08:18: CF:1D" would be matched against what in ES?

Question40: At what point in the ES installation process should Splunk_TA_ForIndexes.spl be deployed to the indexers?

Question41: Which indexes are searched by default for CIM data models?

Question42: After managing source types and extracting fields, which key step comes next In the Add-On Builder?

Question43: Where is detailed information about identities stored?

Question44: How is it possible to navigate to the list of currently-enabled ES correlation searches?

Question45: After data is ingested, which data management step is essential to ensure raw data can be accelerated by a Data Model and used by ES?

Question46: A customer site is experiencing poor performance. The UI response time is high and searches take a very long time to run. Some operations time out and there are errors in the scheduler logs, indicating too many concurrent searches are being started. 6 total correlation searches are scheduled and they have already been tuned to weed out false positives.
Which of the following options is most likely to help performance?