SPLK-3001 Exam Dumps - Splunk Enterprise Security Certified Admin Questions and Answers

Splunk Enterprise Security requires a dedicated search head with no other apps installed. This is because ES is a resource-intensive application that may cause performance issues and conflicts with other apps. Installing ES on a search head with other apps may also result in data loss or corruption. Therefore, it is recommended to install ES on a clean search head with only the default built-in apps and the Common Information Model (CIM) app. The CIM app is a prerequisite for ES and provides a common language for describing data across domains and technologies. The other options, B, C, and D, are not correct. Installing ES on a search head with any other apps, including TA-* or CIM-compliant apps, is not supported and may cause problems. References =

• Install Splunk Enterprise Security
• Splunk Enterprise Security Installation and Upgrade Manual

 According to the Splunk Enterprise Security documentation, the Default Account Activity Detected correlation search uses the Local User Intel lookup table to flag known default accounts. The Local User Intel lookup table contains a list of default usernames and passwords for various systems and applications, such as admin, root, guest, and others. The correlation search compares the authentication events from the Authentication data model with the usernames in the lookup table and generates a notable event if there is a match. The notable event indicates that a default account was used to access a system or application, which could be a sign of a brute force attack or a misconfiguration. Therefore, the correct answer is B. Local User Intel. References =

• Default Account Activity Detected
• Local User Intel

According to the Splunk Enterprise Security documentation, one of the actions that may be necessary before installing ES is to redirect distributed search connections. This action is required if you are installing ES on a search head that is already connected to a distributed search environment, such as a search head cluster or a search head pool. You need to redirect the distributed search connections from the existing search head to a new search head that will run ES. This is because ES requires a dedicated search head that is not shared with other apps or users. You can use the Distributed Configuration Management tool to redirect the distributed search connections and create a Splunk Enterprise Security app for indexers. See Redirect distributed search connections for more details.

The other actions are not necessary before installing ES, but they may be helpful for optimizing the performance and scalability of ES. Purging KV Store can free up some disk space and remove stale data, but it is not required before installing ES. See Purge the KV Store for more information. Adding additional indexers can improve the indexing and searching capacity of ES, but it is not required before installing ES. See Deployment planning for more information. Adding additional forwarders can increase the data ingestion and forwarding capability of ES, but it is not required before installing ES. See Forward data to Splunk Enterprise Security for more information. References =

• Redirect distributed search connections
• Purge the KV Store
• Deployment planning
• Forward data to Splunk Enterprise Security.

 Adaptive response action history is stored in the cim_modactions index. This index contains the events generated by the adaptive response actions that are triggered by correlation searches or run manually from Incident Review. You can use this index to search, audit, and report on the adaptive response actions that have been executed in your environment. You can also view the adaptive response action history on the Adaptive Response dashboard in Enterprise Security1. References =

• Adaptive Response dashboard - Splunk Documentation

According to the Splunk Enterprise Security documentation, when using the Distributed Configuration Management tool to create the Splunk_TA_ForIndexers package, you can include the following three files:

• indexes.conf: This file defines the indexes that are used by Splunk Enterprise Security, such as main, summary, and notable. It also specifies the index settings, such as retention policy, replication factor, and search factor. See indexes.conf for more details.
• props.conf: This file defines the properties of the data sources that are ingested by Splunk Enterprise Security, such as sourcetype, timestamp, line breaking, and field extraction. It also specifies the data model mappings, tags, and event types for the data sources. See props.conf for more details.
• transforms.conf: This file defines the transformations that are applied to the data sources that are ingested by Splunk Enterprise Security, such as lookup definitions, field aliases, field formats, and calculated fields. It also specifies the regex patterns, delimiters, and formats for the transformations. See transforms.conf for more details.

Therefore, the correct answer is A. indexes.conf, props.conf, transforms.conf. References =

• indexes.conf
• props.conf
• transforms.conf

Assigning Role Based Permissions in Splunk Enterprise Security

Splunk Enterprise Security knows the local customer domain names so it can detect internal vs. external emails by using the Corporate Web and Email Domain Lookups. These are lookup files that contain the list of domains that are considered internal or corporate for the organization. The Corporate Web and Email Domain Lookups are edited during the initial configuration of Splunk Enterprise Security, and they are used to enrich events with the tag=internal_web or tag=internal_email fields. These fields indicate whether the web or email activity is internal or external, and they are used by dashboards and correlation searches in Splunk Enterprise Security to monitor and analyze the web and email traffic. References =

• Corporate Web and Email Domain Lookups
• Configure web and email domains in Splunk Enterprise Security

Detecting Typosquatting, Phishing, and Corporate Espionage ... - Splunk

If the number of failed logins is greater than or equal to the threshold value, the search triggers a notable event. To make the search less sensitive, the threshold value can be increased, so that only more frequent failed logins will trigger a notable event. For example, the default threshold value is 4, which means that 4 or more failed logins within a 1-minute window will trigger a notable event. If the threshold value is changed to 10, then only 10 or more failed logins within a 1-minute window will trigger a notable event. References =

• Splunk Enterprise Security Admin Manual
• Detecting brute force access behavior

 This is because ES is a resource-intensive application that requires a dedicated search head with sufficient CPU and memory. Installing ES on the existing search head may cause performance issues and conflicts with other applications. Deleting the non-CIM-compliant apps from the search head is not recommended, as they are mission-critical for the site. Increasing the number of CPUs and amount of memory on the search head may not be enough to handle the load of ES and other applications. Therefore, option B is the most suitable answer. You can find more information about installing ES on this web page1.

 If a username does not match the ‘identity’ column in the identities list, Splunk Enterprise Security checks the ‘email’ column next. The ‘email’ column contains the email address associated with the identity. If the email address matches the username, Splunk Enterprise Security assigns the identity to the user. If the email address does not match, Splunk Enterprise Security checks the ‘nickname’ column next, followed by the ‘ip’ column, and finally the ‘last_name’ and ‘first_name’ columns. The order of the columns is determined by the identity_match setting in the identity_manager.conf file. References =

• Identity correlation
• identity_manager.conf

The endpoint security domain dashboards in Splunk Enterprise Security display endpoint data relating to malware infections, patch history, system configurations, and time synchronization information. The sources for events in the endpoint security domain dashboards are the devices that are considered endpoints in your network, such as workstations, notebooks, and point-of-sale systems1. References = 1: Introduction to the dashboards available in Splunk Enterprise Security - Endpoint domain dashboards.