フリー問題

問題文

A SOC lead is deciding whether to accelerate the Authentication data model. Which statements about data model acceleration are correct? (Select two.)

選択肢

1. Once a data model is accelerated, searches against it always return complete results for any time range, because the summaries are rebuilt on demand when a search reaches past the summary range.
2. Acceleration changes which events fall inside the data model, so accelerating a model is one way to bring newly onboarded source types into scope without editing any field mappings or event type definitions.
3. Acceleration removes the need to schedule the correlation searches that use the model, because the summaries are updated continuously.
4. The data models shipped with the common information model add-on are disabled for acceleration by default, so a SOC that wants acceleration has to turn it on.
5. Acceleration builds summaries in the background and consumes disk space alongside the index buckets, so the summary range setting directly affects how much space is used.