SPLK-1002 · Question #131
Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?
The correct answer is D. Authentication. Authentication is one of the official pre-configured data models included in the Splunk Common Information Model (CIM) add-on.
Question
Which of the following is one of the pre-configured data models included in the Splunk Common Information Model (CIM) add-on?
Options
- AAccess
- BAccounting
- CAuthorization
- DAuthentication
How the community answered
(31 responses)- A3% (1)
- B3% (1)
- D94% (29)
Why each option
Authentication is one of the official pre-configured data models included in the Splunk Common Information Model (CIM) add-on.
There is no CIM data model named 'Access'; web access-related events are covered by the 'Web' data model in the CIM framework.
'Accounting' is not a data model in the Splunk CIM add-on; no such pre-configured model exists in the standard CIM data model set.
'Authorization' is not a standalone CIM data model; related events are typically normalized under the Authentication or Change data models.
The Splunk CIM add-on ships with a defined set of pre-built data models that normalize event data across different sourcetypes and vendors. Authentication is an officially included CIM data model that standardizes fields for login, logout, and authentication failure events from diverse sources.
Concept tested: Splunk CIM add-on pre-configured data model identification
Source: https://docs.splunk.com/Documentation/CIM/latest/User/CIMdatamodels
Topics
Community Discussion
No community discussion yet for this question.