Describe the Splunk CIM SPLK-1002 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Splunk admin has just installed the Splunk CIM Add-On in a new environment. The admin wants to verify that the Add-On is providing the expected data models and tags. What is the most direct way to confirm this?

   • ARun a search for 'index=_internal sourcetype=splunkd' and look for CIM-related log entries.
   • BCreate a new index named 'cim' and verify that data is being written to it.
   • CRestart Splunk and check the 'Monitoring Console' for CIM health metrics.
   • DCheck the 'Data Models' page in Settings to see the CIM data models and review the 'Tags' page for the CIM tags.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A Splunk admin is ingesting Windows Security logs. The logs have a field 'EventCode' that indicates the type of event (e.g., 4624 for successful logon). The admin wants to use the CIM Authentication data model to search for successful logons. What must be configured for the 'EventCode' field to be used by the data model?

   • AA lookup table that translates 'EventCode' values to human-readable descriptions.
   • BA field extraction that maps 'EventCode' to the CIM 'action' field with values like 'success'.
   • CA new data model that includes the 'EventCode' field as a standard field.
   • DAn index-time transformation that renames 'EventCode' to 'action'.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Splunk admin is setting up the CIM for the first time. They notice that some events have the correct fields but are not appearing in the data model searches. The admin has already installed the CIM Add-On. What is the most likely missing configuration?

   • AThe events have not been tagged with the appropriate CIM tag for the data model.
   • BThe events are being indexed into a non-default index that the data model cannot access.
   • CThe field extractions are only applied at index time, not search time.
   • DThe data models have not been accelerated, so they are unavailable for search.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A large enterprise has multiple Splunk environments (production and development). The security team uses the CIM in production for incident response. They are now planning to onboard a new data source (a custom IDS) that has a unique field structure. The team wants to ensure the new data is immediately searchable via the CIM in production without disrupting existing searches. What is the best approach?

   • ADirectly edit the CIM Add-On's props.conf in production to add the new field extractions.
   • BDevelop and test the new field extractions and tags in the development environment, then deploy them to production via a configuration bundle.
   • CCreate a new data model specifically for the IDS data and ignore the existing CIM models.
   • DUse a search-time eval command in every incident response search to manually map the IDS fields.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How does the CIM enable cross-source correlation and analysis?

   • ABy storing all data in a single index
   • BBy automatically generating incident reports
   • CBy standardizing field names and event categories across different data sources
   • DBy requiring all data to be in the same format
   Reveal Solution Discussion Select an answer first