Skip to main content
ITPrepCerts
Login
Exams Free Samples About Contact
Login Create an account

SPLK-3001 Splunk Enterprise Security Certified Admin

  • Splunk
  • 5 free sample questions

About this exam

SPLK-3001 is the Splunk exam Splunk Enterprise Security Certified Admin. Paid practice material for this exam is not available yet, but you can try its free sample questions.

Exam code
SPLK-3001
Vendor
Splunk
Practice questions
Not available yet
Free sample questions
5
Question bank last updated
Not available yet

Try 2 sample questions

Taken from the free sample set for SPLK-3001.

Question 1

The option to create a Short ID for a notable event is located where?

  1. Option A:

    The Additional Fields.

  2. Option B:

    The Event Details.

  3. Option C:

    The Contributing Events.

  4. Option D:

    The Description.

Show answer and explanation

Correct answer: B

 According to the Splunk Enterprise Security documentation, the option to create a Short ID for a notable event is located in the Event Details section of the notable event. The Event Details section shows the basic information about the notable event, such as title, description, urgency, owner, status, and others. It also provides a link to Create Short ID, which generates a 6-digit alphanumeric code that can be used to identify and share the notable event. The Short ID is appended to the URL of the Incident Review dashboard and can be used to filter the notable events by the Short ID field. See  Manually create a notable event in Splunk Enterprise Security  for more details. Therefore, the correct answer is B. The Event Details. References =  Manually create a notable event in Splunk Enterprise Security .

Question 2

Following the Installation of ES, an admin configured Leers with the ©ss_uso r role the ability to close notable events. How would the admin restrict these users from being able to change the status of Resolved notable events to closed?

  1. Option A:

    From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the closed status.

  2. Option B:

    From the Status Configuration windows select the closed status. Remove ess_use r from the status transitions for the Resolved status.

  3. Option C:

    In Enterprise Security, give the ess_user role the own Notable Events permission.

  4. Option D:

    From Splunk Access Controls, select the ess_user role and remove the edit_notabie_events capability.

Show answer and explanation

Correct answer: A

 According to the Splunk Enterprise Security documentation, the Status Configuration window allows you to customize the status values and transitions for notable events. You can define which roles can change the status of a notable event from one value to another, and which roles can view the notable events with a specific status. To restrict the users with the ess_user role from being able to change the status of Resolved notable events to closed, you need to do the following steps:

    On the Enterprise Security menu bar, select Configure > Incident Management > Status Configuration.

    In the Status Configuration window, select the Resolved status from the list of values.

    In the Status Transitions section, find the row for the closed status and click the Edit icon.

    In the Edit Status Transition dialog box, remove the ess_user role from the Roles field and click Save.

    Click Save Changes to apply the changes to the Status Configuration window.

This will prevent the users with the ess_user role from changing the status of any notable event from Resolved to closed. They will still be able to change the status of other notable events to closed, if they have the permission to do so. Therefore, the correct answer is A. From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the closed status. References =  Customize status values and transitions for notable events .

See all 5 free sample questions