SPLK-3002リアル試験問題解答は更新された[2023年11月28日]
お手軽に合格させる 最新Splunk SPLK-3002問題集には54問があります
質問 # 28
Which of the following are the default ports that must be configured on Splunk to use ITSI?
- A. SplunkWeb (8405), SplunkD (8519), and HTTP Collector (8628)
- B. SplunkWeb (8089), SplunkD (8088), and HTTP Collector (8000)
- C. SplunkWeb (8088), SplunkD (8089), and HTTP Collector (8000)
- D. SplunkWeb (8000), SplunkD (8089), and HTTP Collector (8088)
正解：D
解説：
Reference:
C is the correct answer because ITSI uses the default ports of Splunk Enterprise for its communication and data collection. SplunkWeb uses port 8000, SplunkD uses port 8089, and HTTP Event Collector uses port 8088. These ports can be changed if needed, but they must match the configuration of Splunk Enterprise. Reference: Ports used by ITSI
質問 # 29
Which of the following applies when configuring time policies for KPI thresholds?
- A. They are great if you expect normal behavior at 1:00 to be different than normal behavior at 5:00
- B. If a person expects a KPI to change significantly through a cycle on a daily basis, don't use it.
- C. It is possible for multiple time policies to overlap.
- D. A person can only configure 24 policies, one for each hour of the day.
正解：C
解説：
Explanation
If you're creating multiple time policies that require the same threshold values, you can save time by copying the threshold levels and their corresponding values from one policy to another.
質問 # 30
Which of the following describes a realistic troubleshooting workflow in ITSI?
- A. Correlation search -> KPI -> Aggregation Policy
- B. Service Analyzer -> Notable Event Review -> Deep Dive
- C. Correlation Search -> Deep Dive -> Notable Event
- D. Service Analyzer -> Aggregation Policy -> Deep Dive
正解：C
質問 # 31
Which of the following is a recommended best practice for service and glass table design?
- A. Start with base searches, then services, and then glass tables.
- B. Always use the standard icons for glass table widgets to improve portability.
- C. Plan and implement services first, then build detailed glass tables.
- D. Design glass tables first to discover which KPIs are important.
正解：D
質問 # 32
Which capabilities are enabled through "teams"?
- A. Teams allow restrictions to service content in UI views.
- B. Teams allow searches against the itsi_summary index.
- C. Teams restrict searches against the itsi_notable_audit index.
- D. Teams restrict notable event alert actions.
正解：A
解説：
D is the correct answer because teams allow you to restrict access to service content in UI views such as service analyzers, glass tables, deep dives, and episode review. Teams also control access to services and KPIs for editing and viewing purposes. Teams do not affect the ability to search against the itsi_summary index, restrict notable event alert actions, or restrict searches against the itsi_notable_audit index. Reference: Overview of teams in ITSI
質問 # 33
Which capabilities are enabled through "teams"?
- A. Teams allow restrictions to service content in UI views.
- B. Teams restrict searches against the itsi_notable_audit index.
- C. Teams restrict notable event alert actions.
- D. Teams allow searches against the itsi_summary index.
正解：D
解説：
Explanation
Teams provide presentation-layer security only and not data-level security. It's still possible for a user with access to the Splunk search bar to look up ITSI summary index data.
質問 # 34
Which of the following is an advantage of using adaptive time thresholds?
- A. Automatically adjust KPI calculation to manage dynamic event data.
- B. Automatically update thresholds daily to manage dynamic changes to KPI values.
- C. Automatically adjust correlation search thresholds to adjust sensitivity over time.
- D. Automatically adjust aggregation policy grouping to manage escalating severity.
正解：B
解説：
Reference:
Adaptive thresholds are thresholds calculated by machine learning algorithms that dynamically adapt and change based on the KPI's observed behavior. Adaptive thresholds are useful for monitoring KPIs that have unpredictable or seasonal patterns that are difficult to capture with static thresholds. For example, you might use adaptive thresholds for a KPI that measures web traffic volume, which can vary depending on factors such as holidays, promotions, events, and so on. The advantage of using adaptive thresholds is:
A) Automatically update thresholds daily to manage dynamic changes to KPI values. This is true because adaptive thresholds use historical data from a training window to generate threshold values for each time block in a threshold template. Each night at midnight, ITSI recalculates adaptive threshold values for a KPI by organizing the data from the training window into distinct buckets and then analyzing each bucket separately. This way, the thresholds reflect the most recent changes in the KPI data and account for any anomalies or trends.
The other options are not advantages of using adaptive thresholds because:
B) Automatically adjust KPI calculation to manage dynamic event data. This is not true because adaptive thresholds do not affect the KPI calculation, which is based on the base search and the aggregation method. Adaptive thresholds only affect the threshold values that are used to determine the KPI severity level.
C) Automatically adjust aggregation policy grouping to manage escalating severity. This is not true because adaptive thresholds do not affect the aggregation policy, which is a set of rules that determines how to group notable events into episodes. Adaptive thresholds only affect the threshold values that are used to generate notable events based on KPI severity level.
D) Automatically adjust correlation search thresholds to adjust sensitivity over time. This is not true because adaptive thresholds do not affect the correlation search, which is a search that looks for relationships between data points and generates notable events. Adaptive thresholds only affect the threshold values that are used by KPIs, which can be used as inputs for correlation searches.
質問 # 35
Which of the following describes a way to delete multiple duplicate entities in ITSI?
- A. Via c CSV upload.
- B. Via a search using the | deleteentity command.
- C. All of the above.
- D. Via the entity lister page.
正解：C
解説：
D is the correct answer because ITSI provides multiple ways to delete multiple duplicate entities. You can use a CSV upload to overwrite existing entities with new or updated information, or delete them by setting the action field to delete. You can also use the entity lister page to select multiple entities and delete them in bulk. Alternatively, you can use a search command called | deleteentity to delete entities that match certain criteria. Reference: Create and update entities using a CSV file in ITSI, Delete entities in bulk in ITSI, Delete entities using the | deleteentity command in ITSI
質問 # 36
Which glass table feature can be used to toggle displaying KPI values from more than one service on a single widget?
- A. Service dependencies.
- B. Ad-hoc search.
- C. Service templates.
- D. Service swapping.
正解：D
解説：
Reference:
A glass table is a visualization tool that allows you to monitor the interrelationships and dependencies across your IT and business services. You can add metrics like KPIs, ad hoc searches, and service health scores that update in real time against a background that you design. One of the features of glass tables is service swapping, which enables you to toggle displaying KPI values from more than one service on a single widget. You can use service swapping to compare metrics across different services without creating multiple glass tables or widgets. Reference: Overview of the glass table editor in ITSI, [Configure service swapping on glass tables]
質問 # 37
Which of the following is a good use case regarding defining entities for a service?
- A. Being able to split a CPU usage KPI by host name.
- B. Automatically associate entities to services using multiple entity aliases.
- C. All of the entities have the same identifying field name.
- D. KPI total values are aggregated from multiple different category values in the source events.
正解：B
解説：
Explanation
Define entities before creating services. When you configure a service, you can specify entity matching rules based on entity aliases that automatically add the entities to your service.
質問 # 38
What are valid considerations when designing an ITSI Service? (Choose all that apply.)
- A. Backfill of a KPI should always be selected so historical data points can be used immediately and alerts based on that data can occur.
- B. Entities, entity meta-data, and entity rules should be planned carefully to support the service design and configuration.
- C. Service access control requirements for ITSI Team Access should be considered, and appropriate teams provisioned prior to creating the ITSI Service.
- D. Services, entities, and saved searches are stored in the ITSI app, while events created by KPI execution are stored in the itsi_summary index.
正解：B、C、D
解説：
Reference:
A, B, and C are correct answers because service access control requirements for ITSI Team Access should be considered before creating the ITSI Service, as different teams may have different permissions and views of the service data. Entities, entity meta-data, and entity rules should also be planned carefully to support the service design and configuration, as they determine how ITSI maps data sources to services and KPIs. Services, entities, and saved searches are stored in the ITSI app, while events created by KPI execution are stored in the itsi_summary index for faster retrieval and analysis. Reference: ITSI service design best practices, Overview of ITSI indexes
質問 # 39
Which index will contain useful error messages when troubleshooting ITSI issues?
- A. _internal
- B. itsi_summary
- C. _introspection
- D. itsi_notable_audit
正解：A
解説：
Reference:
The index that will contain useful error messages when troubleshooting ITSI issues is:
B) _internal. This is true because the _internal index contains logs and metrics generated by Splunk processes, such as splunkd and metrics.log. These logs can help you diagnose problems with your Splunk environment, including ITSI components and features.
The other indexes will not contain useful error messages because:
A) _introspection. This is not true because the _introspection index contains data about Splunk resource usage, such as CPU, memory, disk space, and so on. These data can help you monitor the performance and health of your Splunk environment, but not the error messages.
C) itsi_summary. This is not true because the itsi_summary index contains summarized data for your KPIs and services, such as health scores, severity levels, threshold values, and so on. These data can help you analyze the trends and anomalies of your IT services, but not the error messages.
D) itsi_notable_audit. This is not true because the itsi_notable_audit index contains audit data for your notable events and episodes, such as creation time, owner
質問 # 40
Which of the following is a best practice for identifying the most effective services with which to start an iterative ITSI deployment?
- A. Only include KPIs if they will be used in multiple services.
- B. Analyze the business to determine the most critical services.
- C. Define a large number of key services early.
- D. Focus on low-level services.
正解：A
質問 # 41
What should be considered when onboarding data into a Splunk index, assuming that ITSI will need to use this data?
- A. Use | stats functions in custom fields to prepare the data for KPI calculations.
- B. Plan to build as many data models as possible for ITSI to leverage
- C. Make sure that all fields conform to CIM, then use the corresponding module to import related services.
- D. Check if the data could leverage pre-built KPIs from modules, then use the correct TA to onboard the data.
正解：D
解説：
Reference:
When onboarding data into a Splunk index, assuming that ITSI will need to use this data, you should consider the following:
B) Check if the data could leverage pre-built KPIs from modules, then use the correct TA to onboard the data. This is true because modules are pre-packaged sets of services, KPIs, and dashboards that are designed for specific types of data sources, such as operating systems, databases, web servers, and so on. Modules help you quickly set up and monitor your IT services using best practices and industry standards. To use modules, you need to install and configure the correct technical add-ons (TAs) that extract and normalize the data fields required by the modules.
The other options are not things you should consider because:
A) Use | stats functions in custom fields to prepare the data for KPI calculations. This is not true because using | stats functions in custom fields can cause performance issues and inaccurate results when calculating KPIs. You should use | stats functions only in base searches or ad hoc searches, not in custom fields.
C) Make sure that all fields conform to CIM, then use the corresponding module to import related services. This is not true because not all modules require CIM-compliant data sources. Some modules have their own data models and field extractions that are specific to their data sources. You should check the documentation of each module to see what data requirements and dependencies they have.
D) Plan to build as many data models as possible for ITSI to leverage. This is not true because building too many data models can cause performance issues and resource consumption in your Splunk environment. You should only build data models that are necessary and relevant for your ITSI use cases.
質問 # 42
Which of the following is the best use case for configuring a Multi-KPI Alert?
- A. Comparing anomaly detection between two KPIs.
- B. Raising an alert when one or more KPIs indicate an outage is occurring.
- C. Comparing content between two notable events.
- D. Using machine learning to evaluate when data falls outside of an expected pattern.
正解：C
質問 # 43
Which of the following are the default ports that must be configured on Splunk to use ITSI?
- A. SplunkWeb (8405), SplunkD (8519), and HTTP Collector (8628)
- B. SplunkWeb (8089), SplunkD (8088), and HTTP Collector (8000)
- C. SplunkWeb (8088), SplunkD (8089), and HTTP Collector (8000)
- D. SplunkWeb (8000), SplunkD (8089), and HTTP Collector (8088)
正解：D
質問 # 44
For which ITSI function is it a best practice to use a 15-30 minute time buffer?
- A. Anomaly detection.
- B. Correlation searches.
- C. Adaptive thresholding.
- D. Maintenance windows
正解：D
解説：
Explanation
It's a best practice to schedule maintenance windows with a 15- to 30-minute time buffer before and after you start and stop your maintenance work. This gives the system an opportunity to catch up with the maintenance state and reduces the chances of ITSI generating false positives during maintenance operations.
質問 # 45
In maintenance mode, which features of KPIs still function?
- A. KPI searches will execute but will be buffered until the maintenance window is over.
- B. KPI searches still run during maintenance mode, but results go to itsi_maintenance_summary index.
- C. KPI calculations and threshold settings can be modified.
- D. New KPIs can be created, but existing KPIs are locked.
正解：A
解説：
Explanation
It's a best practice to schedule maintenance windows with a 15- to 30-minute time buffer before and after you start and stop your maintenance work. This gives the system an opportunity to catch up with the maintenance state and reduces the chances of ITSI generating false positives during maintenance operations.
質問 # 46
......
最新のSPLK-3002学習ガイド2023年最新の- 提供するのはテストエンジンとPDF：https://jp.fast2test.com/SPLK-3002-premium-file.html
最新版を今すぐ試そうSPLK-3002練習テスト問題解答：https://drive.google.com/open?id=1hCLMCqbux2g9l_1YAVEYhcevmyDrK_BI