Explanation
When exporting and importing updates to ES content, you should follow the best practices described in the Splunk Enterprise Security Admin documentation1. One of the best practices is to avoid overwriting existing content on the destination system. To do this, you have two options: either use new app names each time you export content, or always include both existing and new content in each export. This way, you can preserve the original content and avoid conflicts or data loss. The other options, A, B, and C, are not correct. Using new app names each time content is exported is only one of the options, not the only one. Using the .spl extension when naming an export is not a problem, as it is the default extension for Splunk apps. Including only new content for each export is not a good practice, as it may overwrite existing content on the destination system.
References =
Export content from Splunk Enterprise Security as an app

Explanation
The Threat Download Manager is a feature of Splunk Enterprise Security that downloads threat intelligence data from a web server. The Threat Download Manager is a modular input that runs on a schedule and fetches threat intelligence data from various sources, such as STIX/TAXII servers, RSS feeds, or custom URLs. The Threat Download Manager then passes the downloaded data to the Threat Intelligence Parser for further processing12. References = 1: Add threat intelligence to Splunk Enterprise Security - Splunk Documentation - Configure the threat intelligence sources included with Splunk Enterprise Security. 2: Using threat intelligence in Splunk Enterprise Security - Splunk Lantern - Where do I get threat intelligence?

Explanation
Splunk Enterprise Security knows the local customer domain names so it can detect internal vs. external emails by using the Corporate Web and Email Domain Lookups. These are lookup files that contain the list of domains that are considered internal or corporate for the organization. The Corporate Web and Email Domain Lookups are edited during the initial configuration of Splunk Enterprise Security, and they are used to enrich events with the tag=internal_web or tag=internal_email fields. These fields indicate whether the web or email activity is internal or external, and they are used by dashboards and correlation searches in Splunk Enterprise Security to monitor and analyze the web and email traffic. References = Corporate Web and Email Domain Lookups Configure web and email domains in Splunk Enterprise Security Detecting Typosquatting, Phishing, and Corporate Espionage ... - Splunk