What is the purpose of notable event suppression in Splunk Enterprise Security?

To permanently delete notable events from the system

To prevent duplicate or noisy notable events from being generated

To automatically assign an owner to notable events

To increase the severity of notable events

A Splunk environment has a correlation search that generates a notable event every time a single endpoint attempts to connect to a known malicious IP. During a malware outbreak, one infected host generates hundreds of notable events in a few minutes, flooding the Incident Review queue. The analyst wants to generate one notable event per host per day while still detecting new hosts that become infected. Which configuration best achieves this?

Add a `dedup` command to the search to keep only the first event per host.

Enable the 'Suppress' option in the correlation search and set the suppression key to `host` with a suppression period of 24 hours.

Set the correlation search to run once per day instead of every 5 minutes.

Enable the 'Throttle' option and set the throttle key to `host` with a throttle period of 60 minutes.

In a correlation search, where do you configure throttling settings?

In the field extraction settings

In the search's scheduling and alert settings

SplunkCertified Cybersecurity Defense Engineer

Domain 2Objective 4

Generate Effective Notable Events/findings. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 4)

Part of the Detection Engineering domain, which accounts for 40% of the CYBERSECURITY-DEFENSE-ENGINEER exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~12–20 in this domain), expect 2–4 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

10concepts

40%of the exam

Questions 16–20

16foundation · easy
Which notable event attribute is used to assign responsibility for investigating the event?
Select an answer first
17foundation · easy
What is the purpose of notable event suppression in Splunk Enterprise Security?
Select an answer first
18application · medium
A Splunk environment has a correlation search that generates a notable event every time a single endpoint attempts to connect to a known malicious IP. During a malware outbreak, one infected host generates hundreds of notable events in a few minutes, flooding the Incident Review queue. The analyst wants to generate one notable event per host per day while still detecting new hosts that become infected. Which configuration best achieves this?
Select an answer first
19foundation · easy
In a correlation search, where do you configure throttling settings?
Select an answer first
20foundation · easy
Which notable event attribute indicates the importance or criticality of the event?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSECURITY-DEFENSE-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CYBERSECURITY-DEFENSE-ENGINEER” is a trademark of its owner, used for identification only.

Generate Effective Notable Events/findings. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 4)

Questions 16–20

Which notable event attribute is used to assign responsibility for investigating the event?

What is the purpose of notable event suppression in Splunk Enterprise Security?

In a correlation search, where do you configure throttling settings?

Which notable event attribute indicates the importance or criticality of the event?

Keep studying — Detection Engineering