Exam SPLK-5002 Topic 1 Question 13 Discussion

The relevant fields are dest, src, and dvc because these represent asset-oriented entities that can be resolved against asset information in Splunk Enterprise Security. Asset and identity enrichment is intended to add organizational context-including priority-to events based on recognized hosts, devices, and users.
src identifies a source system associated with activity, dest identifies a destination system, and dvc represents a device. When these values resolve to known assets, the associated asset information can provide contextual priority used downstream by security analytics and finding prioritization. This is materially different from user-oriented fields such as user, src_user, or dest_user, which relate to identity resolution rather than asset resolution.
The presence of tag in option B also makes that choice unsuitable: a tag is a classification mechanism and is not one of the asset entity fields used for this lookup relationship.
This illustrates why CIM-aligned field population is important. If asset-identifying data does not populate the expected normalized fields, Enterprise Security may fail to attach the priority and other contextual information expected by downstream detections.
Study Guide topics: Assets and Identities, asset lookup, asset priority, CIM fields, enrichment, src, dest, dvc.