Which indexes are searched by default for CIM data models?

A.

notable and default

B.

summary and notable

C.

_internal and summary

D.

All indexes

What tools does the Risk Analysis dashboard provide?

A.

High risk threats.

B.

Notable event domains displayed by risk score.

C.

A display of the highest risk assets and identities.

D.

Key indicators showing the highest probability correlation searches in the environment

Which two fields combine to create the Urgency of a notable event?

A.

Priority and Severity.

B.

Priority and Criticality.

C.

Criticality and Severity.

D.

Precedence and Time.

Where is the Add-On Builder available from?

A.

GitHub

B.

SplunkBase

C.

www.splunk.com

D.

The ES installation package

Where are attachments to investigations stored?

A.

KV Store

B.

notable index

C.

attachments.csv lookup

D.

<splunk_home>/etc/apps/SA-Investigations/default/ui/views/attachments

Which tool Is used to update indexers In E5?

A.

Index Updater

B.

Distributed Configuration Management

C.

indexes.conf

D.

Splunk_TA_ForIndexeres. spl

When using distributed configuration management to create the Splunk_TA_ForIndexers package, which three files can be included?

A.

indexes.conf, props.conf, transforms.conf

B.

web.conf, props.conf, transforms.conf

C.

inputs.conf, props.conf, transforms.conf

D.

eventtypes.conf, indexes.conf, tags.conf

A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?

A.

Install ES on the existing search head.

B.

Add a new search head and install ES on it.

C.

Increase the number of CPUs and amount of memory on the search head, then install ES.

D.

Delete the non-CIM-compliant apps from the search head, then install ES.

Which of these Is a benefit of data normalization?

A.

Reports run faster because normalized data models can be optimized for better
performance.

B.

Dashboards take longer to build.

C.

Searches can be built no matter the specific source technology for a normalized data type.

D.

Forwarder-based inputs are more efficient.

When ES content is exported, an app with a .spl extension is automatically created. What is the best practice when exporting and importing updates to ES content?

A.

Use new app names each time content is exported.

B.

Do not use the .spl extension when naming an export.

C.

Always include existing and new content for each export.

D.

Either use new app names or always include both existing and new content.