SPLK-3002 IT Service Intelligence Certified Admin Practice Questions
Prepare for SPLK-3002 with more than an answer.
- Exam fee
- $130 USD
- Level
- Professional
- Valid for
- 3 years
Domains covered on the exam 16
- Introducing ITSI5%
- Glass Tables10%
- Managing Notable Events10%
- Investigating Issues with Deep Dives10%
- Installing and Configuring ITSI10%
- Designing Services5%
- Data Audit and Base Searches10%
- Implementing Services10%
- KPI Configuration10%
- Entities and Modules5%
- Templates and Dependencies5%
- Anomaly Detection5%
- Correlation and Multi KPI Searches5%
- Aggregation Policies5%
- Access Control5%
- Administration and Maintenance5%
- 1
An organization has successfully deployed the Splunk Add-on for VMware to collect performance metrics. They now want to use an ITSI Module to automatically create services and KPIs for their vCenter and ESXi hosts. Which ITSI Module should they configure?
Show answer details
Correct answer: D
The ITSI Module for VMware vSphere is the specific content pack designed to work with data from the Splunk Add-on for VMware. It contains pre-configured service templates, KPIs, and entity discovery searches tailored for monitoring a VMware vSphere environment.
- 2
A DevOps team is adopting ITSI for a new cloud-native application. They require a lightweight method for sending application metrics directly to ITSI without using a Universal Forwarder. The metrics are in a JSON format. Which Splunk technology should they use?
Show answer details
Correct answer: C
The HTTP Event Collector (HEC) is the ideal solution for this use case. It provides a secure, high-performance, token-based HTTP/S endpoint for sending data, including metrics in JSON format, directly to Splunk without needing a forwarder. This is a common pattern for cloud-native applications and microservices.
- 3
During the planning phase of an ITSI implementation, an architect determines that the initial deployment will monitor 5 critical services, with an average of 10 KPIs per service. The data retention requirement is 90 days. Based on Splunk's sizing guidelines, these factors primarily influence which hardware component's specification?
Show answer details
Correct answer: A
The number of KPIs and the data retention period are the primary drivers for storage requirements. Each KPI generates summary data that is stored in the
itsi_summaryindex. A higher number of KPIs and a longer retention period (90 days) will directly increase the amount of disk space required on the indexers to store this summary data. - 4
Case Study: A large telecom company, 'ConnectFast', is deploying ITSI to monitor its mobile network services. Their key objective is to reduce incident resolution time for customer-facing issues. They have defined a top-level service called 'Mobile Customer Experience'. This service depends on several underlying services: 'Authentication', 'Data Services', and 'Voice Services'. The NOC team needs a single, comprehensive dashboard for initial triage of any issue affecting the 'Mobile Customer Experience' service.
The NOC manager has the following requirements for the dashboard:
- Show the real-time health score of the top-level service and each of its direct dependencies.
- Display a trend line for the 'Failed Authentication Rate' KPI over the last hour.
- Provide a list of the 5 most recent critical notable events across all dependent services.
- Allow operators to click on a degraded service to navigate directly to its detailed deep dive view for further analysis.
Which ITSI component is best suited to meet all these requirements in a single view?
Show answer details
Correct answer: D
A Glass Table is the only ITSI component that can meet all the specified requirements in a single, customizable view. It allows the creation of a custom layout where you can place: 1) Service Health Score widgets for each service, 2) a Time Series Chart for the KPI trend, 3) a Notable Events list widget, and 4) configure click-actions on the service widgets to link directly to their respective deep dives. This provides the exact consolidated triage view the NOC manager requires.
- 5
Case Study: 'Global Retail Inc.' uses ITSI to monitor their primary e-commerce service. The service has become increasingly complex, with over 50 KPIs. New administrators find it difficult to understand which KPIs are most critical. The lead architect wants to simplify the view in the Service Analyzer so that, by default, only the 10 most critical KPIs are visible, while still allowing users to view all KPIs if needed.
The architect has implemented the following service hierarchy:
graph TD A[E-Commerce Platform] --> B[Web Tier] A --> C[Application Tier] A --> D[Database Tier]The goal is to simplify the KPI view within the 'E-Commerce Platform' service itself.
Which feature should the administrator configure to achieve this?
Show answer details
Correct answer: C
The 'Importance' value of a KPI has a dual purpose. It acts as a multiplier for calculating the service health score, and it controls visibility in the Service Analyzer. By setting the most critical KPIs to a higher importance value (like 11, which is the highest), they will be displayed by default. The Service Analyzer has a configurable slider that allows users to adjust the minimum importance level for visible KPIs, so other KPIs can still be viewed on demand.
- 6
A financial services firm is implementing ITSI to monitor a high-frequency trading application. The application's performance is measured by a 'Trade Execution Latency' KPI, which has a predictable pattern of high activity during market hours (9:30 AM - 4:00 PM ET) and low activity otherwise. The operations team wants to avoid false positive alerts during off-hours. Which ITSI feature should be configured to apply different threshold levels based on the time of day?
Show answer details
Correct answer: B
Time Policies are the correct feature for this scenario. They allow administrators to define different KPI threshold levels for specific time periods, such as business hours versus non-business hours. This directly addresses the need to have stricter thresholds during active trading and looser ones during off-hours to prevent false alarms.
- 7
An ITSI administrator has configured a new correlation search to generate a notable event when a service's health score drops below 60. However, after deploying the search, the team observes that multiple, separate notable events are created for the same service within a short time frame, leading to alert fatigue. Which ITSI configuration should be adjusted to group these related alerts into a single, manageable episode?
Show answer details
Correct answer: B
A Notable Event Aggregation Policy is designed specifically to solve this problem. It groups notable events into episodes based on defined criteria, such as time, CI/entity, or other fields. By creating a policy that groups events from the same service within a specific time window, the administrator can consolidate the multiple alerts into a single episode, reducing noise and simplifying investigation.
- 8
A new ITSI administrator is tasked with creating a backup of the current ITSI configuration, including all services, KPIs, glass tables, and notable event aggregation policies. Which command-line utility is used to perform this operation?
Show answer details
Correct answer: D
The correct utility for backing up and restoring ITSI configurations is the
backup_itsi.pyscript. This script is included with the ITSI installation and is specifically designed to export all ITSI-related KV Store collections and configuration files into a backup archive, which can later be used for restoration. - 9
True or False: When a service is put into maintenance mode in ITSI, its health score calculation is paused, but its KPIs continue to generate notable events by default.
Show answer details
Correct answer: B
This statement is false. When a service is in maintenance mode, both its health score calculation is paused AND notable event generation for its KPIs is suppressed by default. This prevents false alarms and inaccurate health scores during planned maintenance periods.
- 10
An ITSI architect is designing a service model for a large e-commerce platform. The platform consists of hundreds of microservices, many of which are identical but serve different geographic regions (e.g.,
checkout-service-us,checkout-service-eu). To ensure consistency and simplify management, which ITSI features should be used? (Select TWO).Show answer details
Correct answer: B, C
Entity Filtering is crucial for differentiating between the instances. The service template's KPIs can be configured to filter on an entity alias, such as 'region'. When creating services from the template, the administrator can specify 'us' or 'eu' for the region, automatically scoping the KPIs to the correct set of microservice entities.
Service Templates are ideal for this scenario. A single template can be created for the 'checkout-service' with all its associated KPIs. This template can then be used to create multiple service instances, ensuring that monitoring is consistent across all regions.
