Splunk SPLK-3002 Online Practice Questions and Exam Preparation

Splunk SPLK-3002 Online Questions & Answers

• Question 51:

  Which of the following services often has KPIs but no entities?

  A. Security Service.
  B. Network Service.
  C. Business Service.
  D. Technical Service.
  C. Business Service.

• Question 52:

  Which of the following is a recommended best practice for ITSI installation?

  A. ITSI should not be installed on search heads that have Enterprise Security installed.
  B. Before installing ITSI, make sure the Common Information Model (CIM) is installed.
  C. Install the Machine Learning Toolkit app if anomaly detection must be configured.
  D. Install ITSI on one search head in a search head cluster and migrate the configuration bundle to other search heads.
  A. ITSI should not be installed on search heads that have Enterprise Security installed.

• Question 53:

  Which of the following is the best use case for configuring a Multi-KPI Alert?

  A. Comparing content between two notable events.
  B. Using machine learning to evaluate when data falls outside of an expected pattern.
  C. Comparing anomaly detection between two KPIs.
  D. Raising an alert when one or more KPIs indicate an outage is occurring.
  D. Raising an alert when one or more KPIs indicate an outage is occurring.

• Question 54:

  Which of the following is a recommended best practice for service and glass table design?

  A. Plan and implement services first, then build detailed glass tables.
  B. Always use the standard icons for glass table widgets to improve portability.
  C. Start with base searches, then services, and then glass tables.
  D. Design glass tables first to discover which KPIs are important.
  A. Plan and implement services first, then build detailed glass tables.

• Question 55:

  Which of the following is a good use case regarding defining entities for a service?

  A. Automatically associate entities to services using multiple entity aliases.
  B. All of the entities have the same identifying field name.
  C. Being able to split a CPU usage KPI by host name.
  D. KPI total values are aggregated from multiple different category values in the source events.
  A. Automatically associate entities to services using multiple entity aliases.

• Question 56:

  Which of the following items describe ITSI Deep Dive capabilities? (Choose all that apply.)

  A. Comparing a service's notable events over a time period.
  B. Visualizing one or more Service KPIs values by time.
  C. Examining and comparing alert levels for KPIs in a service over time.
  D. Comparing swim lane values for a slice of time.
  B. Visualizing one or more Service KPIs values by time.
  C. Examining and comparing alert levels for KPIs in a service over time.
  D. Comparing swim lane values for a slice of time.

• Question 57:

  Which of the following is a characteristic of custom deep dives?

  A. Allows itoa_analyst roles to add comments.
  B. Requires at least 7 days' data to show anomalies.
  C. Combines metric, event, KPI, and service health score lanes.
  D. Uses drilldown to generate notable events via anomaly detection.
  C. Combines metric, event, KPI, and service health score lanes.

• Question 58:

  What is the minimum number of entities a KPI must be split by in order to use Entity Cohesion anomaly detection?

  A. 3
  B. 4
  C. 5
  D. 2
  D. 2

• Question 59:

  Which of the following applies when configuring time policies for KPI thresholds?

  A. A person can only configure 24 policies, one for each hour of the day.
  B. They are great if you expect normal behavior at 1:00 to be different than normal behavior at 5:00
  C. If a person expects a KPI to change significantly through a cycle on a daily basis, don't use it.
  D. It is possible for multiple time policies to overlap.
  B. They are great if you expect normal behavior at 1:00 to be different than normal behavior at 5:00

• Question 60:

  Which of the following is a good use case for a Multi-KPI alert?

  A. Alerting when the values of two or more KPIs go into maintenance mode.
  B. Alerting when the trend of two or more KPIs indicates service failure is imminent.
  C. Alerting when two or more KPIs are deviating from their typical pattern.
  D. Alerting when comparing the values of two or more KPIs indicates an unusual condition is occurring.
  D. Alerting when comparing the values of two or more KPIs indicates an unusual condition is occurring.