Logging and Indexing Searchable Alert Events core-certified-advanced-power-user Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A large enterprise runs thousands of alerts daily, and the `_internal` index is growing rapidly, causing storage costs to rise. The compliance team requires alert events to be searchable for 18 months. The admin wants to reduce the storage footprint of alert events without losing the ability to search them. Which approach best balances these requirements?

   • ADisable alert logging and rely on the audit logs in the `_internal` index.
   • BCreate a dedicated index for alert events and set its retention to 18 months, while reducing the retention of the `_internal` index.
   • CUse a summary index to store only the alert metadata and discard the raw events.
   • DIncrease the `_internal` index retention to 18 months and accept the storage cost.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the Splunk alert configuration, which setting must be enabled to ensure alert events are written to the index?

   • ALog Event
   • BSchedule Priority
   • CRun as
   • DExpiration
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following best describes the purpose of logging alert events to the index?

   • ATo display alert results in the Splunk dashboard without requiring a search
   • BTo reduce index usage by storing only alert summaries instead of raw events
   • CTo automatically trigger additional alerts when an alert fires
   • DTo provide a permanent, searchable record of alert activity for auditing and troubleshooting
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What determines how long logged alert events remain searchable in the index?

   • AThe search head's cache size
   • BThe number of alerts configured
   • CThe alert's expiration setting
   • DThe index's retention policy (e.g., frozen time period)
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Splunk admin has created a scheduled alert that triggers on a search for failed login attempts. The security team needs to be able to search for these alert events later using the query `index=_internal sourcetype=alert_action`. However, after the alert fires, no events appear in the `_internal` index. The alert action is configured to send an email. What is the most likely reason the alert events are not being logged?

   • AThe `_internal` index is not searchable by default and requires special permissions to be queried.
   • BThe 'Log alert events' checkbox is disabled in the alert configuration, so no alert action event is written to `_internal`.
   • CThe alert action is set to 'Email' only, and email actions do not generate loggable alert events.
   • DThe alert must be configured with a webhook action in addition to email to generate loggable events.
   Reveal Solution Discussion Select an answer first