Latest [Feb 09, 2022] Splunk SPLK-3002 Real Exam Dumps PDF
SPLK-3002 Practice Test Questions Updated 54 Questions
Splunk SPLK-3002 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
| Topic 7 |
|
NEW QUESTION 30
There are two departments using ITSI. Finance and Sales. Analysts in each department should not be allowed to see each other's services. What are the role configuration steps required to accomplish this?
- A. itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_team_analyst.
- B. itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_team_analyst; itoa_sales_analyst, inherited from itoa_team_analyst.
- C. itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_analyst.
- D. itoa_finance_admin, inherited from itoa_team_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_analyst.
Answer: A
NEW QUESTION 31
Which of the following applies when configuring time policies for KPI thresholds?
- A. A person can only configure 24 policies, one for each hour of the day.
- B. They are great if you expect normal behavior at 1:00 to be different than normal behavior at 5:00
- C. If a person expects a KPI to change significantly through a cycle on a daily basis, don't use it.
- D. It is possible for multiple time policies to overlap.
Answer: D
Explanation:
Explanation
If you're creating multiple time policies that require the same threshold values, you can save time by copying the threshold levels and their corresponding values from one policy to another.
NEW QUESTION 32
Which of the following accurately describes base searches used for KPIs in a service?
- A. Base searches can be used for multiple services.
- B. A base search can only be used by its service and all dependent services.
- C. All the KPIs in a service use the same base search.
- D. All the metrics in a base search are used by one service.
Answer: A
Explanation:
Explanation
KPI base searches let you share a search definition across multiple KPIs in IT Service Intelligence (ITSI).
Create base searches to consolidate multiple similar KPIs, reduce search load, and improve search performance.
NEW QUESTION 33
Which of the following is a best practice when configuring maintenance windows?
- A. Change the color of services and entities that are part of an open maintenance window in the service analyzer.
- B. Disable any glass tables that reference a KPI that is part of an open maintenance window.
- C. Develop a strategy for configuring a service's notable event generation when the service's maintenance window is open.
- D. Give the maintenance window a buffer, for example, 15 minutes before and after actual maintenance work.
Answer: D
Explanation:
Explanation
It's a best practice to schedule maintenance windows with a 15- to 30-minute time buffer before and after you start and stop your maintenance work.
NEW QUESTION 34
What effects does the KPI importance weight of 11 have on the overall health score of a service?
- A. It is a minimum health indicator KPI.
- B. At least 10% of the KPIs will go critical.
- C. The service will go critical.
- D. Importance weight is unused for health scoring.
Answer: A
NEW QUESTION 35
In Episode Review, what is the result of clicking an episode's Acknowledge button?
- A. Change status from New to Acknowledged and assign the current user as owner.
- B. Assign the current user as owner.
- C. Change status from New to Acknowledged.
- D. Change status from New to In Progress and assign the current user as owner.
Answer: D
Explanation:
Explanation
When an episode warrants investigation, the analyst acknowledges the episode, which moves the status from New to In Progress.
NEW QUESTION 36
Which index contains ITSI Episodes?
- A. itsi_notable_archive
- B. itsi_tracked_alerts
- C. itsi_grouped_alerts
- D. itsi_summary
Answer: A
NEW QUESTION 37
Which scenario would benefit most by implementing ITSI?
- A. Monitoring of retail sales metrics.
- B. Monitoring of business services functionality.
- C. Monitoring of system process statuses
- D. Monitoring of system hardware.
Answer: B
NEW QUESTION 38
Which of the following is an advantage of using adaptive time thresholds?
- A. Automatically adjust KPI calculation to manage dynamic event data.
- B. Automatically adjust aggregation policy grouping to manage escalating severity.
- C. Automatically update thresholds daily to manage dynamic changes to KPI values.
- D. Automatically adjust correlation search thresholds to adjust sensitivity over time.
Answer: C
NEW QUESTION 39
When installing ITSI to support a Distributed Search Architecture, which of the following items apply?
(Choose all that apply.)
- A. Copy SA-IndexCreation to the etc/apps directory on the index cluster master node.
- B. Extract ITSI app package into etc/apps directory of search head.
- C. Copy SA-IndexCreation to all indexers.
- D. Extract installer package into etc/apps directory of the cluster deployer node.
Answer: C
Explanation:
Explanation
Copy SA-IndexCreation to $SPLUNK_HOME/etc/apps/ on all individual indexers in your environment.
NEW QUESTION 40
Which index is used to store KPI values?
- A. itsi_summary_metrics
- B. itsi_service_health
- C. itsi_summary
- D. itsi_metrics
Answer: A
Explanation:
Explanation
The IT Service Intelligence (ITSI) metrics summary index, itsi_summary_metrics, is a metrics-based summary index that stores KPI data.
NEW QUESTION 41
Which of the following best describes a default deep dive?
- A. It initially shows the health scores for all services.
- B. It initially shows the highest importance KPIs.
- C. It initially shows all the entity swim lanes.
- D. It initially shows all of the KPIs for a selected service.
Answer: C
NEW QUESTION 42
Which of the following is a best practice for identifying the most effective services with which to start an iterative ITSI deployment?
- A. Analyze the business to determine the most critical services.
- B. Only include KPIs if they will be used in multiple services.
- C. Define a large number of key services early.
- D. Focus on low-level services.
Answer: B
NEW QUESTION 43
Within a correlation search, dynamic field values can be specified with what syntax?
- A. fieldname
- B. <fieldname /fieldname>
- C. %fieldname%
- D. eval(fieldname)
Answer: A
NEW QUESTION 44
Which of the following is the best use case for configuring a Multi-KPI Alert?
- A. Raising an alert when one or more KPIs indicate an outage is occurring.
- B. Comparing content between two notable events.
- C. Comparing anomaly detection between two KPIs.
- D. Using machine learning to evaluate when data falls outside of an expected pattern.
Answer: B
NEW QUESTION 45
Which of the following are deployment recommendations for ITSI? (Choose all that apply.)
- A. Deployments require a dedicated ITSI search head.
- B. Deployments should use fastest possible disk arrays for indexers.
- C. Deployments may increase the number of required indexers based on the number of KPI searches.
- D. Deployments often require an increase of hardware resources above base Splunk requirements.
Answer: A,C,D
Explanation:
Explanation
You might need to increase the hardware specifications of your own Enterprise Security deployment above the minimum hardware requirements depending on your environment.
Install Splunk Enterprise Security on a dedicated search head or search head cluster.
The Splunk platform uses indexers to scale horizontally. The number of indexers required in an Enterprise Security deployment varies based on the data volume, data type, retention requirements, search type, and search concurrency.
NEW QUESTION 46
How do you automatically restrict a KPI to only the entities in its service, and generate KPI values for each entity?
- A. Select "Yes" for both "Split by Entity" and "Filter to Entities in Service".
- B. Select "No" for both "Split by Entity" and "Filter to Entities in Service".
- C. Select "No" for "Split by Entity" and "Yes" for "Filter to Entities in Service".
- D. Select "Yes" for "Split by Entity" and "No" for "Filter to Entities in Service".
Answer: A
NEW QUESTION 47
Which of the following is a valid type of Multi-KPI Alert?
- A. Score over composite.
- B. Rise over run.
- C. Status over time.
- D. Value over time.
Answer: C
NEW QUESTION 48
When deploying ITSI on a distributed Splunk installation, which component must be installed on the search head(s)?
- A. SA-ITSI-Licensechecker
- B. ITSI app
- C. SA-ITOA
- D. All ITSI components
Answer: A
Explanation:
Explanation
Install SA-ITSI-Licensechecker and SA-UserAccess on any license master in a distributed or search head cluster environment. If a search head in your environment is also a license master, the license master components are installed when you install ITSI on the search heads.
NEW QUESTION 49
What is an episode?
- A. A notable event group.
- B. A deep dive.
- C. A notable event.
- D. A workflow task.
Answer: C
Explanation:
Explanation
It's a deduplicated group of notable events occurring as part of a larger sequence, or an incident or period considered in isolation.
NEW QUESTION 50
Which of the following is a good use case regarding defining entities for a service?
- A. All of the entities have the same identifying field name.
- B. KPI total values are aggregated from multiple different category values in the source events.
- C. Being able to split a CPU usage KPI by host name.
- D. Automatically associate entities to services using multiple entity aliases.
Answer: D
Explanation:
Explanation
Define entities before creating services. When you configure a service, you can specify entity matching rules based on entity aliases that automatically add the entities to your service.
NEW QUESTION 51
......
Splunk SPLK-3002 Dumps - Secret To Pass in First Attempt: https://www.prep4surereview.com/SPLK-3002-latest-braindumps.html
SPLK-3002 Dumps - Grab Out For [NEW-2022] Splunk Exam: https://drive.google.com/open?id=1liKktsKYH8fIWoZdihlIS70swnOkIdwE
