The Add-On Builder creates Splunk Apps that start with what?

1. A. DA-
2. B. SA-
3. C. TA-
4. D. App-

Correct Answer: C
Reference: https://dev.splunk.com/enterprise/docs/developapps/enterprisesecurity/abouttheessolution/

An administrator wants to ensure that none of the ES indexed data could be compromised through tampering. What feature would satisfy this requirement?

1. A. Index consistency.
2. B. Data integrity control.
3. C. Indexer acknowledgement.
4. D. Index access permissions.

Correct Answer: B
Reference: https://answers.splunk.com/answers/790783/anti-tampering-features-to-protect-splunk-logs-the.html

Which data model populated the panels on the Risk Analysis dashboard?

1. A. Risk
2. B. Audit
3. C. Domain analysis
4. D. Threat intelligence

Correct Answer: A
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/RiskAnalysis#Dashboard_panels

In order to include an eventtype in a data model node, what is the next step after extracting the correct fields?

1. A. Save the settings.
2. B. Apply the correct tags.
3. C. Run the correct search.
4. D. Visit the CIM dashboard.

Correct Answer: C
Reference: https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizeOSSECdata

The Brute Force Access Behavior Detected correlation search is enabled, and is generating many false positives. Assuming the input data has already been validated. How can the correlation search be made less sensitive?

1. A. Edit the search and modify the notable event status field to make the notable events less urgent.
2. B. Edit the search, look for where or xswhere statements, and after the threshold value being compared to make it less common match.
3. C. Edit the search, look for where or xswhere statements, and alter the threshold value being compared to make it a more common match.
4. D. Modify the urgency table for this correlation search and add a new severity level to make notable events from this search less urgent.

Correct Answer: B
Reference: https://docs.splunk.com/Documentation/ES/6.1.0/User/Howurgencyisassigned