SPLK-3001 無料問題集「Splunk Enterprise Security Certified Admin」

（A）The ES installation package

（B）GitHub

（C）SplunkBase

（D）www.splunk.com

（A）Configure -> Navigation Menu

（B）Settings -> User Interface -> Navigation -> Click on "Enterprise Security"

（C）Settings -> User Interface -> Navigation Menus -> Click on "default" next to SplunkEnterpriseSecuritySuite

（D）Configure -> General -> Navigation

（A）A display of the highest risk assets and identities.

（B）Key indicators showing the highest probability correlation searches in the environment.

（C）Notable event domains displayed by risk score.

（D）High risk threats.

（A）Add heavy forwarders between the universal forwarders and indexers so inputs can be parsed before indexing.

（B）Increase memory and CPUs on the search head(s) and add additional indexers.

（C）If indexed realtime search is enabled, disable it for the notable index.

（D）Change the search heads to do local indexing of summary searches.

（A）Settings -> Searches, Reports, and Alerts -> Filter by Name of "Correlation"

（B）Configure -> Correlation Searches -> Select Status "Enabled"

（C）Configure -> Content Management -> Select Type "Correlation" and Status "Enabled"

（D）Settings -> Searches, Reports, and Alerts -> Select App of "SplunkEnterpriseSecuritySuite" and filter by
"- Rule"

（A）Change the correlation search's default status and severity.

（B）Modify the correlation schedule and sensitivity for your site.

（C）Suppress notable events from that correlation search.

（D）Disable acceleration for the correlation search to reduce storage requirements.

（A）Download the latest version of KV Store from MongoDBxom.

（B）Configure search head forwarding.

（C）Disable the default search app.

（D）Install the latest Python distribution on the search head.

（A）Web and email domain names are set in General -> General Configuration.

（B）The Corporate Web and Email Domain Lookups are edited during initial configuration.

（C）ES extracts local email and web domains automatically from SMTP and HTTP logs.

（D）ES uses the User Activity index and applies machine learning to determine internal and external domains.

（A）The Analyst Bar.

（B）The Investigation Bar.

（C）The Investigator Workbench.

（D）The Compliance Bar.

（A）Configure -> Content Management -> Type: Correlation Search -> Notable -> Next Steps -> Nslookup

（B）Configure -> Content Management -> Type: Correlation Search -> Notable -> Nslookup

（C）Configure -> Type: Correlation Search -> Notable -> Recommended Actions -> Nslookup

（D）Configure -> Content Management -> Type: Correlation Search -> Notable -> Recommended Actions
-> Nslookup