Use the CIM Add-On to Normalize Data SPLK-1002 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A team is troubleshooting why events from a new data source are not appearing in the CIM Authentication data model. They have confirmed that the events are tagged correctly, the source type is correct, and the field aliases are defined. What is the next step to diagnose the issue?

   • ACheck if the data model is accelerated.
   • BRun a search to check if the events have the required fields for the Authentication data model.
   • CCheck if the events are being indexed into the default index.
   • DVerify that the CIM Add-On is installed on the search head.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company has multiple teams using Splunk for different purposes (security, IT operations). Each team has its own field naming conventions. The leadership wants to enable cross-team searches and dashboards. What is the best approach?

   • AUse the 'lookup' command to map fields in every search.
   • BRequire all teams to use the same source types for their data.
   • CAdopt the CIM Add-On to standardize field names and event categorization across all teams.
   • DCreate a single index for all data and rely on the index to unify the data.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of the Splunk Common Information Model (CIM) Add-On?

   • ATo replace the need for indexers and search heads by storing all normalized data in a separate database
   • BTo provide a graphical interface for building dashboards without writing search queries
   • CTo automatically encrypt all data at rest and in transit within a Splunk deployment
   • DTo provide a standardized data model with consistent field names and event categorization across different data sources
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which search would you use to verify that events are correctly tagged for the Authentication data model?

   • A`sourcetype=WinEventLog:Security`
   • B`tag=authentication`
   • C`eventtype=authentication`
   • D`index=_internal`
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An analyst is verifying that events from a new data source are correctly normalized. They run a search against the CIM Network Traffic data model and see that the src_ip field is populated, but the dest_ip field is empty for some events. The raw data contains a field named 'destination_ip'. What is the most likely cause?

   • AThe events are missing the Network Traffic tag.
   • BThe field alias for 'destination_ip' to 'dest_ip' is not defined for all events.
   • CThe source type is incorrect.
   • DThe data model is not accelerated.
   Reveal Solution Discussion Select an answer first