Splunk SPLK-3001 Exam questions with correct answers

Which of the following threat intelligence types can ES download? (Choose all that apply.) · A. Text · B. STIX/TAXII · C. VulnScanSPL · D. SplunkEnterpriseThreatGenerator CORRECT ANSWER Text and STIX/TAXII When investigating, what is the best way to store a newly-found IOC? A. Paste it into Notepad. B. Click the Add IOC button. C. Click the Add Artifact button. D. Add it in a text note to the investigation. CORRECT ANSWER Click the Add Artifact button. At what point in the ES installation process should Splunk_TA_ForI be deployed to the indexers? · A. When adding apps to the deployment server. · B. Splunk_TA_ForI is installed first. · C. After installing ES on the search head(s) and running the distributed configuration management tool. · D. Splunk_TA_ForI is only installed on indexer cluster sites using the cluster master and the splunk apply cluster-bundle command. CORRECT ANSWER After installing ES on the search head(s) and running the distributed configuration management tool.