A company ingests firewall logs from a vendor that uses the field 'source_ip'. The CIM Network Traffic data model expects 'src_ip'. The team has created a field alias in the CIM Add-On. What is the result?

The 'source_ip' field will be renamed to 'src_ip' in the raw data.

Searches using 'src_ip' will return events that have the 'source_ip' field.

The events will be automatically tagged with the Network Traffic tag.

The 'source_ip' field will be removed from the events.

A search using the Authentication data model returns no results, but the underlying events exist. What is the most likely cause?

The events are missing the required 'authentication' tag

The events are stored in a different index

The search head is not connected to the indexers

The events are too old and have been archived

An organization is ingesting data from a new security appliance. The data has a unique source type. The team wants to use the CIM Endpoint data model. They have created a field alias for the process name field. What else must they do to ensure the events are normalized?

Apply the appropriate tags to the events, such as 'endpoint' and 'process'.

Enable Data Model acceleration for the Endpoint data model.

Create a new index for the data.

Configure the source type to match an existing CIM-compatible source type.

An analyst is investigating a security incident and wants to use the CIM Endpoint data model to search for process execution events. Which component of the data model should the analyst use to ensure they are searching the correct events?

The tag 'endpoint' combined with the event type 'process'

The required field 'process_id'

SplunkCore Certified Power User

Domain 10Objective 3

Use the CIM Add-On to Normalize Data SPLK-1002 Practice Questions (Page 2)

Part of the Using the Common Information Model (CIM) Add-On domain, which accounts for 10% of the SPLK-1002 exam. Splunk does not publish an official question count, but from its 60-minute exam (~25–40 total, ~3–4 in this domain), expect 1–1 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

6concepts

10%of the exam

Questions 6–10

6application · medium
A company ingests firewall logs from a vendor that uses the field 'source_ip'. The CIM Network Traffic data model expects 'src_ip'. The team has created a field alias in the CIM Add-On. What is the result?
Select an answer first
7foundation · easy
A search using the Authentication data model returns no results, but the underlying events exist. What is the most likely cause?
Select an answer first
8expert · hard
An organization is ingesting data from a new security appliance. The data has a unique source type. The team wants to use the CIM Endpoint data model. They have created a field alias for the process name field. What else must they do to ensure the events are normalized?
Select an answer first
9application · medium
An analyst is investigating a security incident and wants to use the CIM Endpoint data model to search for process execution events. Which component of the data model should the analyst use to ensure they are searching the correct events?
Select an answer first
10foundation · easy
Which of the following is a key CIM data model used for analyzing security-related events?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-1002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-1002” is a trademark of its owner, used for identification only.