Splunk SPLK-3002 Online Practice Questions and Exam Preparation

Splunk SPLK-3002 Online Questions & Answers

• Question 61:

  Which capabilities are enabled through "teams"?

  A. Teams allow searches against the itsi_summary index.
  B. Teams restrict notable event alert actions.
  C. Teams restrict searches against the itsi_notable_audit index.
  D. Teams allow restrictions to service content in UI views.
  D. Teams allow restrictions to service content in UI views.

• Question 62:

  Which views would help an analyst identify that a memory usage KPI is going critical? (select all that apply)

  A. Memory KPI in a glass table.
  B. Memory panel of the OS Host Details view in the Operating System module.
  C. Memory swim lane in a Deep Dive.
  D. Service and KPI tiles in the Service Analyzer.
  A. Memory KPI in a glass table.
  B. Memory panel of the OS Host Details view in the Operating System module.
  C. Memory swim lane in a Deep Dive.
  D. Service and KPI tiles in the Service Analyzer.

• Question 63:

  After a notable event has been closed, how long will the meta data for that event remain in the KV Store by default?

  A. 6 months.
  B. 9 months.
  C. 1 year.
  D. 3 months.
  A. 6 months.

• Question 64:

  How do you automatically restrict a KPI to only the entities in its service, and generate KPI values for each entity?

  A. Select "Yes" for both "Split by Entity" and "Filter to Entities in Service".
  B. Select "No" for "Split by Entity" and "Yes" for "Filter to Entities in Service".
  C. Select "Yes" for "Split by Entity" and "No" for "Filter to Entities in Service".
  D. Select "No" for both "Split by Entity" and "Filter to Entities in Service".
  A. Select "Yes" for both "Split by Entity" and "Filter to Entities in Service".

• Question 65:

  What happens when an anomaly is detected?

  A. A separate correlation search needs to be created in order to see it.
  B. A SNMP trap will be sent.
  C. An anomaly alert will appear in core splunk, in index=main.
  D. An anomaly alert will appear as a notable event in Episode Review.
  D. An anomaly alert will appear as a notable event in Episode Review.

• Question 66:

  There are two departments using ITSI. Finance and Sales. Analysts in each department should not be allowed to see each other's services. What are the role configuration steps required to accomplish this?

  A. itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_analyst.
  B. itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_team_analyst; itoa_sales_analyst, inherited from itoa_team_analyst.
  C. itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_team_analyst.
  D. itoa_finance_admin, inherited from itoa_team_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_analyst.
  C. itoa_finance_admin, inherited from itoa_admin; itoa_sales_admin, inherited from itoa_team_admin; itoa_finance_analyst, inherited from itoa_analyst; itoa_sales_analyst, inherited from itoa_team_analyst.

• Question 67:

  How should entities be handled during the data audit phase of requirements gathering?

  A. Entity meta-data for info and aliases should be identified and recorded as requirements.
  B. Entities should be noted based upon Service KPI requirements such as 'by host' or 'by product line'.
  C. Entities must be identified for every Service KPI defined and recorded in requirements.
  D. Entities identified should be included in the entity filtering requirements, such as 'by processld' or 'by host'.
  A. Entity meta-data for info and aliases should be identified and recorded as requirements.

• Question 68:

  Which of the following describes entities? (Choose all that apply.)

  A. Entities must be IT devices, such as routers and switches, and must be identified by either IP value, host name, or mac address.
  B. An abstract (pseudo/logical) entity can be used to split by for a KPI, although no entity rules or filtering can be used to limit data to a specific service.
  C. Multiple entities can share the same alias value, but must have different role values.
  D. To automatically restrict the KPI to only the entities in a particular service, select "Filter to Entities in Service".
  B. An abstract (pseudo/logical) entity can be used to split by for a KPI, although no entity rules or filtering can be used to limit data to a specific service.
  D. To automatically restrict the KPI to only the entities in a particular service, select "Filter to Entities in Service".

• Question 69:

  Which of the following best describes an ITSI Glass Table?

  A. A view which displays a system topology overlaid with KPI metrics.
  B. A view which describes a topology.
  C. A dashboard which displays a system topology.
  D. A view showing KPI values in a variety of visual styles.
  A. A view which displays a system topology overlaid with KPI metrics.

• Question 70:

  Which of the following is a best practice when configuring maintenance windows?

  A. Disable any glass tables that reference a KPI that is part of an open maintenance window.
  B. Develop a strategy for configuring a service's notable event generation when the service's maintenance window is open.
  C. Give the maintenance window a buffer, for example, 15 minutes before and after actual maintenance work.
  D. Change the color of services and entities that are part of an open maintenance window in the service analyzer.
  C. Give the maintenance window a buffer, for example, 15 minutes before and after actual maintenance work.