nerdexam
Splunk

SPLK-1002 · Question #131

Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

The correct answer is D. Authentication. Authentication is one of the official pre-configured data models included in the Splunk Common Information Model (CIM) add-on.

Using the Common Information Model Add-On

Question

Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?

Options

  • AAccess
  • BAccounting
  • CAuthorization
  • DAuthentication

How the community answered

(31 responses)
  • A
    3% (1)
  • B
    3% (1)
  • D
    94% (29)

Why each option

Authentication is one of the official pre-configured data models included in the Splunk Common Information Model (CIM) add-on.

AAccess

There is no CIM data model named 'Access'; web access-related events are covered by the 'Web' data model in the CIM framework.

BAccounting

'Accounting' is not a data model in the Splunk CIM add-on; no such pre-configured model exists in the standard CIM data model set.

CAuthorization

'Authorization' is not a standalone CIM data model; related events are typically normalized under the Authentication or Change data models.

DAuthenticationCorrect

The Splunk CIM add-on ships with a defined set of pre-built data models that normalize event data across different sourcetypes and vendors. Authentication is an officially included CIM data model that standardizes fields for login, logout, and authentication failure events from diverse sources.

Concept tested: Splunk CIM add-on pre-configured data model identification

Source: https://docs.splunk.com/Documentation/CIM/latest/User/CIMdatamodels

Topics

#Splunk CIM#Data Models#CIM Data Models#Authentication Data Model

Community Discussion

No community discussion yet for this question.

Full SPLK-1002 Practice