Which of the following is an adaptive action that is configured by default for ES?

ACreate notable event

BCreate new correlation search

CCreate investigation

DCreate new asset

Answer : A

Which of the following are the default ports that must be configured for Splunk Enterprise Security to function?

ASplunkWeb (8068), Splunk Management (8089), KV Store (8000)

BSplunkWeb (8390), Splunk Management (8323), KV Store (8672)

CSplunkWeb (8000), Splunk Management (8089), KV Store (8191)

DSplunkWeb (8043), Splunk Management (8088), KV Store (8191)

Answer : C

Which tool Is used to update indexers In E5?

AIndex Updater

BDistributed Configuration Management

Cindexes.conf

DSplunk_TA_ForIndexeres. spl

Answer : B

Which of the following actions may be necessary before installing ES?

ARedirect distributed search connections.

BPurge KV Store.

CAdd additional indexers.

DAdd additional forwarders.

Answer : C

When using distributed configuration management to create the Splunk_TA_ForIndexers package, which three files can be included?

Aindexes.conf, props.conf, transforms.conf

Bweb.conf, props.conf, transforms.conf

Cinputs.conf, props.conf, transforms.conf

Deventtypes.conf, indexes.conf, tags.conf

Answer : A

Free Practice Questions for Splunk SPLK-3001 Exam