Use the CIM Add-On to Normalize Data SPLK-1002 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A team is troubleshooting why events from a new data source are not appearing in the CIM Network Traffic data model. They have confirmed that the events are tagged correctly. What should they check next?

   • ACheck if the data model is accelerated.
   • BEnsure the events are being indexed into the default index.
   • CVerify that the field mappings for src_ip and dest_ip are correctly defined in the CIM Add-On.
   • DConfirm that the CIM Add-On is installed on the search head.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has multiple teams using Splunk with different data sources. They want to create a unified security dashboard that shows authentication and network traffic events. The teams have different field names for similar data. What is the best way to achieve this?

   • ACreate a dashboard that uses separate searches for each team's data and combines the results.
   • BUse the CIM Add-On to normalize all data and then search across the Authentication and Network Traffic data models.
   • CCreate a new index for all data and rely on the index to unify the data.
   • DUse the 'join' command to combine events from different sources in a single search.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A security analyst wants to correlate authentication events from Windows, Linux, and VPN logs in a single search. How does the CIM Add-On help achieve this?

   • ABy automatically merging all logs into a single index regardless of their source type
   • BBy creating a separate normalized copy of each event in a new index named 'cim'
   • CBy mapping source-specific fields to common CIM field names and applying standard tags
   • DBy requiring all data sources to be configured with the same source type before indexing
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When configuring a new data input for firewall logs, what is the recommended approach to ensure the data is normalized by the CIM Add-On?

   • ADisable all field extractions to let the CIM Add-On handle everything automatically
   • BUse the same source type for all firewall vendors to simplify configuration
   • CCreate a new index named 'firewall' and set the source type to 'cim'
   • DAssign a source type that matches the vendor's format and ensure the CIM Add-On's tagging rules are applied
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An administrator has enabled Data Model acceleration for the CIM Authentication data model. What is the primary benefit of this action?

   • AThe CIM Add-On will automatically tag all authentication events.
   • BThe data model will be visible in the CIM Add-On's configuration.
   • CSearches against the data model run faster because the data is pre-summarized.
   • DThe data model automatically fixes any field mapping issues.
   Reveal Solution Discussion Select an answer first