List the Knowledge Objects Included with the Splunk CIM Add-On SPLK-1002 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the structure of a CIM data model used for?

   • ATo categorize data into logical groups
   • BTo map data to CIM data models
   • CTo enrich data with external information
   • DTo define the structure for CIM-compliant searches
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is investigating a security incident and wants to search for all authentication-related events across their environment. They have the CIM Add-On installed. Which approach would be most efficient for this task?

   • ASearch using the CIM Authentication data model
   • BSearch using the field extraction for authentication fields
   • CSearch the raw index for 'authentication' in the event text
   • DSearch using a lookup that contains all authentication event IDs
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An administrator is troubleshooting why Windows Event Log data is not appearing in the CIM 'Windows' data model. The data is being indexed correctly and the CIM Add-On is installed. Which of the following is the most likely reason the data is not showing up in the data model?

   • AThe data model must be manually edited to include the Windows Event Log sourcetype
   • BThe field extractions for Windows Event Logs are not compatible with the data model
   • CThe data model requires a lookup to be manually populated with Windows event IDs
   • DThe appropriate CIM event type has not been enabled for the Windows Event Log sourcetype
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization is using the CIM Add-On to normalize web proxy logs. After enabling the relevant event types and tags, they notice that the 'src' field is not being populated in the Web data model. Which knowledge object from the CIM Add-On is most likely responsible for populating this field?

   • AA field extraction that normalizes the vendor's source IP field to 'src'
   • BA data model constraint that defines which events are included
   • CA lookup that maps vendor-specific field names to CIM standard names
   • DAn event type that categorizes the web proxy data
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst has ingested firewall logs into Splunk and wants to use the CIM Add-On to make the data searchable via the Network data model. The analyst has already installed the add-on. Which additional action is required to ensure the firewall data is properly mapped to the Network data model?

   • AEnable the appropriate event types and apply the corresponding CIM tags to the firewall data
   • BManually create field extractions for all firewall fields
   • CRun the CIM Validation tool and accept all recommended changes automatically
   • DCreate a new lookup table to map firewall vendors to CIM field names
   Reveal Solution Discussion Select an answer first