QUESTION: 33

ES apps and add-ons from $SPLUNK_HOME/etc/apps should be copied from the staging instance to what location on the cluster deployer instance?

$SPLUNK_HOME/etc/master-apps/
$SPLUNK_HOME/etc/system/local/
$SPLUNK_HOME/etc/shcluster/apps
$SPLUNK_HOME/var/run/searchpeers/

Answer(s): C

Explanation:

The upgraded contents of the staging instance will be migrated back to the deployer and deployed to the search head cluster members. On the staging instance, copy $SPLUNK_HOME/etc/apps to $SPLUNK_HOME/etc/ shcluster/apps on the deployer. 1. On the deployer, remove any deprecated apps or add-ons in $SPLUNK_HOME/etc/shcluster/apps that were removed during the upgrade on staging. Confirm by reviewing the ES upgrade report generated on staging, or by examining the apps moved into $SPLUNK_HOME/etc/ disabled-apps on staging

Reveal Solution Next Question

QUESTION: 34

How is notable event urgency calculated?

Asset priority and threat weight.
Alert severity found by the correlation search.
Asset or identity risk and severity found by the correlation search.
Severity set by the correlation search and priority assigned to the associated asset or identity.

Answer(s): D