Splunk Splunk Certifications SPLK-3002 Questions & Answers

• Question 31:

  What is the default importance value for dependent services’ health scores?

  A. 11

  B. 1

  C. Unassigned

  D. 10

  Correct Answer: A

  By default, impacting service health scores have an importance value of 11. Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/Dependencies

• Question 32:

  What is the main purpose of the service analyzer?

  A. Display a list of All Services and Entities.

  B. Trigger external alerts based on threshold violations.

  C. Allow Analysts to add comments to Alerts.

  D. Monitor overall Service and KPI status.

  Correct Answer: C

  Alerts and Sharing Reference: https://docs.splunk.com/Documentation/MSExchange/4.0.3/Reference/ServiceAnalyzer

• Question 33:

  Which of the following applies when configuring time policies for KPI thresholds?

  A. A person can only configure 24 policies, one for each hour of the day.

  B. They are great if you expect normal behavior at 1:00 to be different than normal behavior at 5:00

  C. If a person expects a KPI to change significantly through a cycle on a daily basis, don't use it.

  D. It is possible for multiple time policies to overlap.

  Correct Answer: D

  If you're creating multiple time policies that require the same threshold values, you can save time by copying the threshold levels and their corresponding values from one policy to another

  Reference: https://docs.splunk.com/Documentation/ITSI/4.9.1/SI/TimePolicies

• Question 34:

  Which of the following is an advantage of using adaptive time thresholds?

  A. Automatically update thresholds daily to manage dynamic changes to KPI values.

  B. Automatically adjust KPI calculation to manage dynamic event data.

  C. Automatically adjust aggregation policy grouping to manage escalating severity.

  D. Automatically adjust correlation search thresholds to adjust sensitivity over time.

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/TimePolicies

• Question 35:

  What effects does the KPI importance weight of 11 have on the overall health score of a service?

  A. At least 10% of the KPIs will go critical.

  B. Importance weight is unused for health scoring.

  C. The service will go critical.

  D. It is a minimum health indicator KPI.

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/KPIImportance#:~:text=ITSI% 20considers%20KPIs%20that%20have,other%20KPIs%20in%20the%20service

• Question 36:

  ITSI Saved Search Scheduling is configured to use realtime_schedule = 0. Which statement is accurate about this configuration?

  A. If this value is set to 0, the scheduler bases its determination of the next scheduled search execution time on the current time.

  B. If this value is set to 0, the scheduler bases its determination of the next scheduled search on the last search execution time.

  C. If this value is set to 0, the scheduler may skip scheduled execution periods.

  D. If this value is set to 0, the scheduler might skip some execution periods to make sure that the scheduler is executing the searches running over the most recent time range.

  Correct Answer: B

  If set to 0, the scheduler determines the next scheduled search run time based on the last run time for the search. This is called continuous scheduling.

  Reference: https://docs.splunk.com/Documentation/DFS/1.1.2/DFS/Savedsearchesconf

• Question 37:

  Which scenario would benefit most by implementing ITSI?

  A. Monitoring of business services functionality.

  B. Monitoring of system hardware.

  C. Monitoring of system process statuses.

  D. Monitoring of retail sales metrics.

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/AboutSI

• Question 38:

  Which of the following accurately describes base searches used for KPIs in a service?

  A. Base searches can be used for multiple services.

  B. A base search can only be used by its service and all dependent services.

  C. All the metrics in a base search are used by one service.

  D. All the KPIs in a service use the same base search.

  Correct Answer: A

  KPI base searches let you share a search definition across multiple KPIs in IT Service Intelligence (ITSI). Create base searches to consolidate multiple similar KPIs, reduce search load, and improve search performance.

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/BaseSearch

• Question 39:

  Which of the following describes a realistic troubleshooting workflow in ITSI?

  A. Correlation Search –andgt; Deep Dive –andgt; Notable Event

  B. Service Analyzer –andgt; Notable Event Review –andgt; Deep Dive

  C. Service Analyzer –andgt; Aggregation Policy –andgt; Deep Dive

  D. Correlation search –andgt; KPI –andgt; Aggregation Policy

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/IModules/Troubleshootingmodules

• Question 40:

  Which of the following describes entities? (Choose all that apply.)

  A. Entities must be IT devices, such as routers and switches, and must be identified by either IP value, host name, or mac address.

  B. An abstract (pseudo/logical) entity can be used to split by for a KPI, although no entity rules or filtering can be used to limit data to a specific service.

  C. Multiple entities can share the same alias value, but must have different role values.

  D. To automatically restrict the KPI to only the entities in a particular service, select “Filter to Entities in

  Service”.

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/ITSI/4.10.2/SI/KPIfilter