최신Splunk Enterprise Security Certified Admin - SPLK-3001무료샘플문제

A. Recommended Actions show a textual description to an analyst, Adaptive Response Actions show them encoded.

B. Recommended Actions show a list of Adaptive Responses that have already been run, Adaptive Response Actions run them automatically.

C. Recommended Actions show a list of Adaptive Responses to an analyst, Adaptive Response Actions run them automatically.

D. Recommended Actions show a list of Adaptive Resposes to an analyst, Adaptive Response Actions run manually with analyst intervention.

A. Dynamic lookups

B. Tstats

C. KV Store

D. Data models

A. 5.7

B. 3.4

C. 2.5

D. 1.0

A. Disable indexed real-time search.

B. Add notable event suppressions for correlation searches with high numbers of false positives.

C. Increase priority of all correlation searches.

D. Reduce the frequency (schedule) of lower-priority correlation searches.

A. Technology add-on.

B. SA-CIM.

C. ES application.

D. SA-Notable.

A. Modify the correlation schedule and sensitivity for your site.

B. Change the correlation search's default status and severity.

C. Suppress notable events from that correlation search.

D. Disable acceleration for the correlation search to reduce storage requirements.

A. Threat intelligence framework aggregates malicious indicators from community intelligence repositories automatically.

B. Adaptive response framework integrates automated actions with external security platforms.

C. Asset investigator framework visualizes user and system relationship investigation contexts clearly.

D. KV store framework manages application-level structured data within Splunk environments efficiently.

A. From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the Closed status.

B. From the Status Configuration window select the Closed status. Remove ess_user from the status transitions for the Resolved status.

C. From Splunk Access Controls, select the ess_user role and remove the edit_notable_events capability.

D. In Enterprise Security, give the ess_user role the Own Notable Events permission.