Use the CIM Add-On to Normalize Data SPLK-1002 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst wants to search for authentication events across multiple data sources using the CIM Authentication data model. Which search syntax should they use?

   • A| tstats count from datamodel=Authentication where Authentication.tag=authentication
   • B| search Authentication
   • C| datamodel Authentication search
   • Dsearch index=* sourcetype=* authentication
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What must be configured on incoming data to ensure the CIM Add-On can normalize it correctly?

   • AA dedicated index for each data source
   • BA lookup table mapping all possible field values
   • CThe correct source type and appropriate tags
   • DA custom search head for each data source
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the purpose of Data Model acceleration in the context of the CIM Add-On?

   • ATo compress the data in the index to save disk space
   • BTo speed up searches on CIM data models by pre-computing and storing summarized data
   • CTo create a backup of the data model definitions
   • DTo automatically fix any field mapping errors in the normalized data
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   During normalization, what is applied to an event to indicate that it belongs to a specific CIM data model?

   • AA permission setting
   • BA new source type
   • CA tag such as 'authentication' or 'network'
   • DA new index name
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team ingests firewall logs from multiple vendors. Each vendor uses different field names for source IP (e.g., src_ip, SourceAddress, SRC). The team wants to run a single search that works across all vendors. What is the most efficient way to achieve this?

   • AUse the CIM Add-On to map vendor fields to CIM-compliant field names and apply the Network Traffic data model tags.
   • BRename fields in the raw data using the rename command in every search.
   • CCreate a separate search for each vendor and manually combine results in a dashboard.
   • DUse the eval command to create a new field for source IP in each search.
   Reveal Solution Discussion Select an answer first