What does the risk framework add to an object (user, server or other type) to indicate increased risk?

Answer(s): C

https://docs.splunk.com/Documentation/ES/6.1.0/User/RiskScoring

Which indexes are searched by default for CIM data models?

Answer(s): D

https://answers.splunk.com/answers/600354/indexes-searched-by-cim-data-models.html

Which setting is used in indexes.conf to specify alternate locations for accelerated storage?

Answer(s): B

https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Acceleratedatamodels

Which of the following is a way to test for a property normalized data model?

Use Audit -> Normalization Audit and check the Errors panel.
Run a | datamodel search, compare results to the CIM documentation for the datamodel.
Run a | loadjob search, look at tag values and compare them to known tags based on the encoding.
Run a | datamodel search and compare the results to the list of data models in the ES normalization guide.

Answer(s): B

https://docs.splunk.com/Documentation/CIM/4.15.0/User/UsetheCIMtonormalizedataatsearchtime

Free SPLK-3001 Exam Braindumps (page: 3)