Splunk 3001 - Enterprise Security Admin Questions with correct answers

with correct answers The Add-On Builder creates Splunk Apps that start with what? A. DA- B. SA- C. TA- D. App- CORRECT ANSWER C. TA- Which of the following are examples of sources for events in the endpoint security domain dashboards? A. REST API invocations. B. Investigation final results status. C. Workstations, notebooks, and point-of-sale systems. D. Lifecycle auditing of incidents, from assignment to resolution. CORRECT ANSWER C. Workstations, notebooks, and point-of-sale systems. When creating custom correlation searches, what format is used to embed field values in the title, description, and drill-down fields of a notable event? A. $fieldname$ B. ג€fieldnameג€ C. %fieldname% D. _fieldname_ CORRECT ANSWER A. $fieldname$ What feature of Enterprise Security downloads threat intelligence data from a web server? A. Threat Service Manager B. Threat Download Manager