Describe the Splunk CIM SPLK-1002 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   How do CIM tags facilitate the automatic mapping of data to the appropriate model?

   • ABy requiring manual assignment of events to data models
   • BBy using field extractions to determine the data model
   • CBy storing the data model definition inside each event
   • DBy matching the tag name to the data model name
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the role of the Splunk CIM Add-On?

   • ATo provide the data models, tags, and field extractions needed to implement the CIM
   • BTo provide a user interface for building dashboards
   • CTo replace the need for data inputs and indexers
   • DTo automatically install all Splunk apps
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company ingests proxy logs where the client IP is stored in a field named 'c_ip' and the destination URL is in 'cs_uri_path'. The security team wants to use the CIM Web data model to analyze this data. What is the role of CIM field extractions in this scenario?

   • AThey rename the fields 'c_ip' and 'cs_uri_path' to 'src' and 'url' in the raw data before indexing.
   • BThey create a lookup table that translates 'c_ip' to 'src' for every event.
   • CThey create search-time fields that map 'c_ip' to 'src' and 'cs_uri_path' to 'url' so the Web data model can use them.
   • DThey automatically convert the proxy logs into a JSON format that the Web data model requires.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is an example of a CIM data model domain?

   • AWeb
   • BDatabase
   • CAuthentication
   • DEmail
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security operations team ingests firewall logs from Palo Alto, Cisco ASA, and Check Point devices. They want to run a single search that correlates failed login attempts across all three sources without writing separate queries for each vendor's log format. Which approach best achieves this using the Splunk CIM?

   • AConfigure each firewall to send logs in a common vendor-neutral format such as CEF before ingestion.
   • BCreate a custom search that uses vendor-specific field names for each source and combines results with a union command.
   • CUse the 'tstats' command directly on the raw _raw field to extract login outcomes from each vendor's logs.
   • DInstall the CIM Add-On, apply the Authentication data model, and ensure the firewall data is tagged with 'authentication' so it maps to the model's standard fields.
   Reveal Solution Discussion Select an answer first