Splunk Certified Enterprise Security Administrator –
Study Questions & Answers
1. The Add-On Builder creates Splunk Apps that start with what TA prefix?
Answer: Apps created with Add-On Builder start with the prefix Splunk_TA_.
2. Which of the following are examples of sources for workstation, notebook, and point-of-
sale system events in the endpoint security domain dashboards?
Answer: Workstations, notebooks, and point-of-sale systems are examples of endpoint
event sources.
3. When creating custom correlation searches, what format is used to embed field values in
the title, description, and drill-down fields of a notable event?
Answer: The format $fieldname$ is used to embed field values.
4. What feature of Enterprise Security downloads threat intelligence data from a web
server?
Answer: The Threat Intelligence Download Manager downloads threat intelligence data.
5. The Remote Access panel within the User Activity dashboard is not populating with the
most recent hour of data. What data model should be checked for skipped searches or
authentication errors?
Answer: The Authentication data model should be checked.
6. In order to include an eventtype in a data model node after extracting the correct fields,
what is the next step?
Answer: Run the correct search to associate the eventtype with the data model node.
7. What role should be assigned to a security team member who will be taking ownership of
notable events in the Incident Review dashboard?
Answer: The role ess_analyst should be assigned.
8. Which column in the Asset or Identity list is combined with event severity to determine a
notable event's urgency?
Answer: The Priority column.
, 9. What does the risk framework add to an object (user, server, or other entity) to indicate
increased risk?
Answer: A numeric risk score.
10. Which indexes are searched by default for CIM data models?
Answer: All indexes.
11. Which setting in indexes.conf specifies alternate tstatsHomePath locations for accelerated
storage?
Answer: The tstatsHomePath setting.
12. Which method can be used to test whether data conforms to a normalized CIM data
model?
Answer: Run a | datamodel search and compare results to the CIM documentation.
13. Which argument to the | tstats command restricts the search to summarized data only?
Answer: summariesonly=t.
14. When investigating, what is the best way to store a newly discovered IOC?
Answer: Click the “Add Artifact” button.
15. How can you navigate to the list of currently enabled ES correlation searches?
Answer: Go to Configure → Content → Content Management → Select Type
“Correlation” and Status “Enabled”.
16. What is a risk of using the Auto Deployment feature of Distributed Configuration
Management to distribute indexes.conf?
Answer: Indexes may have different settings across distributed instances.
17. Which of the following is an ES data model?
Answer: Anomalies.
18. At what point in the ES installation process should Splunk_TA_ForIndexers.spl be
deployed to the indexers?
Answer: After installing ES on the search head(s) and running the Distributed
Configuration Management tool.
19. Which correlation search feature is used to throttle the creation of notable events?
Answer: Window duration.
Study Questions & Answers
1. The Add-On Builder creates Splunk Apps that start with what TA prefix?
Answer: Apps created with Add-On Builder start with the prefix Splunk_TA_.
2. Which of the following are examples of sources for workstation, notebook, and point-of-
sale system events in the endpoint security domain dashboards?
Answer: Workstations, notebooks, and point-of-sale systems are examples of endpoint
event sources.
3. When creating custom correlation searches, what format is used to embed field values in
the title, description, and drill-down fields of a notable event?
Answer: The format $fieldname$ is used to embed field values.
4. What feature of Enterprise Security downloads threat intelligence data from a web
server?
Answer: The Threat Intelligence Download Manager downloads threat intelligence data.
5. The Remote Access panel within the User Activity dashboard is not populating with the
most recent hour of data. What data model should be checked for skipped searches or
authentication errors?
Answer: The Authentication data model should be checked.
6. In order to include an eventtype in a data model node after extracting the correct fields,
what is the next step?
Answer: Run the correct search to associate the eventtype with the data model node.
7. What role should be assigned to a security team member who will be taking ownership of
notable events in the Incident Review dashboard?
Answer: The role ess_analyst should be assigned.
8. Which column in the Asset or Identity list is combined with event severity to determine a
notable event's urgency?
Answer: The Priority column.
, 9. What does the risk framework add to an object (user, server, or other entity) to indicate
increased risk?
Answer: A numeric risk score.
10. Which indexes are searched by default for CIM data models?
Answer: All indexes.
11. Which setting in indexes.conf specifies alternate tstatsHomePath locations for accelerated
storage?
Answer: The tstatsHomePath setting.
12. Which method can be used to test whether data conforms to a normalized CIM data
model?
Answer: Run a | datamodel search and compare results to the CIM documentation.
13. Which argument to the | tstats command restricts the search to summarized data only?
Answer: summariesonly=t.
14. When investigating, what is the best way to store a newly discovered IOC?
Answer: Click the “Add Artifact” button.
15. How can you navigate to the list of currently enabled ES correlation searches?
Answer: Go to Configure → Content → Content Management → Select Type
“Correlation” and Status “Enabled”.
16. What is a risk of using the Auto Deployment feature of Distributed Configuration
Management to distribute indexes.conf?
Answer: Indexes may have different settings across distributed instances.
17. Which of the following is an ES data model?
Answer: Anomalies.
18. At what point in the ES installation process should Splunk_TA_ForIndexers.spl be
deployed to the indexers?
Answer: After installing ES on the search head(s) and running the Distributed
Configuration Management tool.
19. Which correlation search feature is used to throttle the creation of notable events?
Answer: Window duration.
