SPLK-3001 無料問題集「Splunk Enterprise Security Certified Admin」

（A）Disable indexed real-time search.

（B）Reduce the frequency (schedule) of lower-priority correlation searches.

（C）Add notable event suppressions for correlation searches with high numbers of false positives.

（D）Increase priority of all correlation searches.

（A）Workstations, notebooks, and point-of-sale systems.

（B）Lifecycle auditing of incidents, from assignment to resolution.

（C）REST API invocations.

（D）Investigation final results status.

（A）Normalize raw authentication events into Common Information Model compliant field structures.

（B）Accelerate distributed searches using clustered index replication optimization across environments automatically.

（C）Store structured application data supporting lookups and ES functionality requirements.

（D）Visualize executive dashboards summarizing enterprise-wide security incident management statistics efficiently.

（A）Add heavy forwarders between the universal forwarders and indexers so inputs can be parsed before indexing.

（B）Increase memory and CPUs on the search head(s) and add additional indexers.

（C）If indexed realtime search is enabled, disable it for the notable index.

（D）Change the search heads to do local indexing of summary searches.

（A）A user.

（B）An identity.

（C）A device.

（D）An asset.

（A）Edit the search, look for where or xswhere statements, and alter the threshold value being compared to make it a more common match.

（B）Edit the search and modify the notable event status field to make the notable events less urgent.

（C）Modify the urgency table for this correlation search and add a new severity level to make notable events from this search less urgent.

（D）Edit the search, look for where or xswhere statements, and after the threshold value being compared to make it less common match.

（A）ess_analyst

（B）ess_admin

（C）ess_user

（D）ess_reviewer