Splunk IT Service Intelligence Admin (SPLK-3002) Certification Sample Questions

02. A retailer's customer-facing ordering service is modeled in ITSI with its own KPIs. The database platform and the payment platform it relies on are monitored today only as a loose collection of host searches that nobody has organized into ITSI objects.
The team wants the ordering service's health score to move when either of those platforms degrades. Which three must be in place?
(Choose three.)
a) The database platform and the payment platform are each modeled as services in ITSI.
b) Each of those services carries KPIs of its own, so that it has a health score to contribute.
c) A correlation search raises a notable event when both platforms degrade.
d) The ordering service declares a dependency on each of them in its own configuration.

03. An operations group has asked to be taken off an internal reporting service, which they consider noisy and which belongs to another department. That department already holds the service in its own service-level team.
The ITSI administrator removes the service from the operations group's team. What does that change, and what does it leave untouched?
a) The group no longer sees the service; the alerting it drives is suppressed, and stays suppressed until the service is put back into a team.
b) The group no longer sees the service, and its KPI searches stop running for them, so the events that had been reaching them are no longer generated at all.
c) The group no longer sees the service; its KPIs and notable events carry on.
d) The group no longer sees the service, and its health score stops being calculated for it.

04. A database service is watched from two saved views: the default deep dive ITSI provides for that service, and a custom deep dive that was saved last quarter with three chosen lanes. A replication-lag KPI is added to the service this morning.
Which two statements describe what the team sees the next time each of those views is opened?
(Choose two.)
a) The default deep dive draws a lane for replication lag, because it is built from the service's KPI list at the moment it is opened.
b) Both views pick up the replication-lag lane, since every deep dive reads the service's current KPI list each time it is opened rather than holding a list of its own.
c) The custom deep dive still opens with the three lanes it was saved with, since they are what was saved.
d) Neither view draws replication lag until a lane for it is added by hand, because deep dives hold lanes rather than KPI lists.

05. Two services - internal file sharing and customer portal - each carry a CPU utilization KPI, and both KPIs are fed by the same base search over the whole hypervisor estate.
Both services report an identical CPU figure, and the file-sharing service's health worsens on the evenings when the portal's hosts are busiest.
What accounts for this?
a) The two services have no dependency defined between them, so ITSI cannot separate their health scores and reports the higher-level figure on both.
b) Both KPIs use adaptive thresholds learned from the same history, so identical values map onto identical severities.
c) Sharing one base search between two services is not supported in ITSI, so the second service configured simply reads the first service's results instead of calculating its own.
d) The shared search returns the whole estate, and neither KPI has been filtered to the entities belonging to its own service.

06. A platform team is briefed before ITSI is added to the Splunk deployment they already run, and asks what the installation itself will bring with it. Which description identifies what ITSI adds, rather than what it reuses from the platform?
a) A scheduler of its own, which ITSI uses to run its searches.
b) The ITSI app and its supporting components, along with the searches that produce and record its KPI results.
c) The forwarders and data inputs for the hosts behind each service, together with the indexes that hold the events those inputs collect.
d) An indexing tier of its own, so that its searches never read the same indexes the platform's other users search.

07. An administrator is writing up how alerting is put together for a newly launched online ordering service, so that the operations team understands where its notable events come from. Which two statements about ITSI correlation searches are accurate?
(Choose two.)
a) The notable events it raises stay available to review for as long as the deployment's retention settings keep them.
b) A correlation search evaluates the ordering service's KPIs against their thresholds and updates the service health score whenever one of them is breached.
c) A correlation search runs on a schedule, so a matching condition becomes a notable event when the search next runs.
d) A correlation search assigns each notable event it raises to the episode that event will be reviewed in.

08. One aggregation policy currently matches every notable event a deployment raises. The network team and the storage team each work their own incidents, and both are now being assigned the same episode, which holds network events and storage events together. Neither team can close it without touching work that belongs to the other.
What should the administrator change?
a) Put the network services and the storage services into separate ITSI teams, so that each team's users can see only their own services.
b) Have each team's correlation searches raise their events into separate episodes.
c) Give each team its own custom view of notable events, filtered to the events that team owns, so each sees only the work it is responsible for.
d) Split the policy into two, each matching only one team's events, so each team's events form episodes of their own.

09. A video-streaming provider has an approved design for an edge delivery service. The design names the six edge cache nodes that make up the service, four KPIs, and the entity rule that assigns those nodes to it.
The implementer has created the service and its four KPIs. Each KPI is returning a figure calculated from every cache node in the estate, not from the six named in the design.
Which two changes bring the implementation into line with the design?
(Choose two.)
a) Apply a service template to the edge delivery service so that the six cache nodes inherit the KPI definitions the design specifies.
b) Set the four KPIs to filter to the entities assigned to the service, so that each one measures only those six cache nodes and not the wider estate.
c) Raise the thresholds on the four KPIs so that the readings contributed by cache nodes outside the service stop pushing it into a worse severity.
d) Import the cache nodes as entities and define the rule that assigns the six named in the design to this service.

10. A glass table for the corporate email service carries a shape bound to the service itself and, beside it, shapes bound to three of that service's KPIs: mailbox login success, message queue latency and message store availability. The email service declares no dependencies on other services.
During the morning the service shape steps to a worse severity while all three KPI shapes stay where they were. What accounts for what the operator is seeing?
a) A KPI of the email service that is not on this table has degraded, since the score rolls up every KPI the service carries and not only the drawn ones.
b) A service that the email service depends on has degraded, and the health of a depended-on service is carried into the score of the service that depends on it, which is what moved the shape.
c) The thresholds behind the three drawn KPIs are set so wide that readings which have genuinely degraded are still reported at a good severity, so their shapes have stayed where they were.
d) The service shape reports a condition of the service itself, separate from its KPIs, so it can move while every KPI stays as it was.