The housing authority wants a documented check that account-takeover content is actually usable. What is the correct sequence?
Select an answer to reveal the explanation.
Short Explanation
Catalog, ingredients, pantry check, then the dashboard. SSE names the account-takeover use case and the sourcetypes it needs; ES confirms those sources are really there; the Security Domain view is the last look. Do not enable everything first and ask questions later.
Full Explanation
When the housing authority wants a documented check that account-takeover content is actually usable, the correct sequence is use-case-driven: pick the use case in Splunk Security Essentials, note the required sourcetypes, confirm they exist and are mapped in Enterprise Security, then open the matching Security Domain dashboard as a live sanity check. Catalog, ingredients, pantry check, then the dashboard. That order proves prerequisites before anyone declares the content ready for operations. Skipping steps produces false readiness.
Opening a Security Domain dashboard first, then inventing the required sourcetypes in a lookup, reverses evidence and fabricates prerequisites. Enabling every Enterprise Security correlation search, then asking Security Essentials which sourcetypes those searches needed, enables blindly and asks questions backward. Skipping Security Essentials and writing a Core dashboard XML file as the only assessment replaces the product workflow with homemade XML that does not validate data-source readiness.
Exam caveat: usability-check stems expect SSE use case → required sourcetypes → ES existence/mapping → Security Domain verification—not invent-then-dashboard, enable-all-first, or Core-XML-only.
Operational check: select account-takeover in SSE, record required identity and related sourcetypes, verify each is present and CIM-mapped in ES for the housing authority, open the matching Security Domain view for non-empty live data, and file gaps before marking the use case usable.