Multiple Choice
A site has a single existing search head which hosts a mix of both CIM and non-CIM compliant applications. All of the applications are mission-critical. The customer wants to carefully control cost, but wants good ES performance. What is the best practice for installing ES?
A) Install ES on the existing search head.
B) Add a new search head and install ES on it.
C) Increase the number of CPUs and amount of memory on the search head, then install ES.
D) Delete the non-CIM-compliant apps from the search head, then install ES.
Correct Answer:

Verified
Correct Answer:
Verified
Q56: Where are attachments to investigations stored?<br>A) KV
Q57: Which of the following would allow an
Q58: Enterprise Security's dashboards primarily pull data from
Q59: Glass tables can display static images and
Q60: Which settings indicates that the correlation search
Q62: Which of the following threat intelligence types
Q63: The Remote Access panel within the User
Q64: Which of the following is a recommended
Q65: What is the maximum recommended volume of
Q66: Who can delete an investigation?<br>A) ess_admin users