View Fired Alerts SPLK-1001 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   When viewing a fired alert on the Alerts page, which field tells you the exact moment the alert condition was met?

   • AStatus
   • BOwner
   • CTrigger time
   • DAlert name
   Reveal Solution Discussion Select an answer first
2. 7expert · medium

   An analyst needs to modify the search query of an alert that has fired multiple times. They want to keep the existing fired alert history for auditing. What is the best approach?

   • ADisable the alert, edit it, and then re-enable it.
   • BDelete the alert and recreate it with the new search query.
   • CEdit the alert definition directly; the fired alert history remains unchanged.
   • DClone the alert and edit the clone, leaving the original unchanged.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A user sees a fired alert with the status 'Suppressed'. What does this status indicate?

   • AThe alert fired but the action was not executed because of throttling.
   • BThe alert was manually disabled by an administrator.
   • CThe alert fired and the action was executed successfully.
   • DThe alert did not fire because the search returned no results.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A system administrator reviews the fired alerts list and sees an entry with the status 'Triggered'. What does this status indicate about the alert?

   • AThe alert fired but the action failed to execute.
   • BThe alert was created but has not yet run.
   • CThe alert fired and the results were saved to a summary index.
   • DThe alert condition was met and the alert fired.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst notices a fired alert entry that is no longer relevant and wants to remove it from the list. What is the correct way to delete a single fired alert entry?

   • AEdit the alert definition and change the schedule.
   • BDisable the alert in the alert definition.
   • CClick the 'Delete' button next to the fired alert entry.
   • DRun a search to delete the alert's results.
   Reveal Solution Discussion Select an answer first