Question 1

Which of the following is a best practice for identifying the most effective services with which to start an iterative ITSI deployment?

Options :

A : Only include KPIs if they will be used in multiple services.

B : Analyze the business to determine the most critical services.

C : Focus on low-level services

D : Define a large number of key services early.

Answer: A

Question 2

Which ITSI components are required before a module can be created?

Options :

A : One or more entity import saved searches.

B : One or more services with KPIs and their associated base searches.

C : One or more datamodels.

D : One or more correlation searches and their associated entities.

Answer: C

Question 3

When troubleshooting KPI search performance, which search names in job activity identify base searches?

Options :

A : Indicator - XXXX - Base Search

B : Indicator - Shared - xxxx - ITSI Search

C : Indicator - Base - xxxx - ITSI Search

D : Indicator - Base - XXXX - Shared Search

Answer: B

Question 4

When deploying ITS! on a distributed Splunk installation. which component must be installed on the search head(s)?

Options :

A : SA-ITOA

B : ITSI app

C : All ITSI components

D : SA-ITSI-Licensechecker

Answer: D

Question 5

In Episode Review, what is the result of clicking an episode's Acknowledge button?

Options :

A : Assign the current user as owner.

B : Change status from New to Acknowledged

C : Change status from New to In Progress and assign the current user as owner

D : Change status from New to Acknowledged and assign the current user as owner.

Answer: C

Free SPLK-3002 Mock Exam – Practice Online Confidently