[UPDATED 2023] Read SPLK-1003 Study Guide Cover to Cover as Literally [Q47-Q70]

NO.47 Which parent directory contains the configuration files in Splunk?
$SPLUNK_HOME/etc

$SPLUNK_HOME/var

$SPLUNK_HOME/conf

$SPLUNK_HOME/default

NO.48 Which of the following applies only to Splunk index data integrity check?

Lookup table

Summary Index

Raw data in the index

Data model acceleration

NO.49 Consider the following stanza ininputs.conf:

What will the value of the source filed be for events generated by this scripts input?

/opt/splunk/ecc/apps/search/bin/liscer.sh

unknown

liscer

liscer.sh

NO.50 On the deployment server, administrators can map clients to server classes using client filters. Which of the following statements is accurate?

The blacklist takes precedence over the whitelist.

The whitelist takes precedence over the blacklist.

Wildcards are not supported in any client filters.

Machine type filters are applied before the whitelist and blacklist.

NO.51 In inputs. conf, which stanza would mean Splunk was only reading one local file?

[read://opt/log/crashlog/Jan27crash.txt]

[monitor::/ opt/log/crashlog/Jan27crash.txt]

[monitor:/// opt/log/]

[monitor:/// opt/log/ crashlog/Jan27crash.txt]

NO.52 Which of the following apply to how distributed search works? (select all that apply)

The search head dispatches searches to the peers

The search peers pull the data from the forwarders.

Peers run searches in parallel and return their portion of results.

The search head consolidates the individual results and prepares reports

NO.53 How is a remote monitor input distributed to forwarders?

As an app.

As a forward.conf file.

As a monitor.conf file.

As a forwarder monitor profile.

NO.54 The Splunk administrator wants to ensure data is distributed evenly amongst the indexers. To do this, he runs the following search over the last 24 hours:
index=*
What field can the administrator check to see the data distribution?

host

index

linecount

splunk_server

NO.55 To set up a Network input in Splunk, what needs to be specified’?

File path.

Username and password

Network protocol and port number.

Network protocol and MAC address.

NO.56 In inputs. conf, which stanza would mean Splunk was only reading one local file?

[read://opt/log/crashlog/Jan27crash.txt]

[monitor::/ opt/log/crashlog/Jan27crash.txt]

[monitor:/// opt/log/]

[monitor:/// opt/log/ crashlog/Jan27crash.txt]

NO.57 When are knowledge bundles distributed to search peers?

After a user logs in.

When Splunk is restarted.

When adding a new search peer.

When a distributed search is initiated.

NO.58 In case of a conflict between a whitelist and a blacklist input setting, which one is used?

Blacklist

Whitelist

They cancel each other out.

Whichever is entered into the configuration first.

NO.59 The universal forwarder has which capabilities when sending data? (Choose all that apply.)

Sending alerts

Compressing data

Obfuscating/hiding data

Indexer acknowledgement

NO.60 Which is a valid stanza for a network input?
[udp://172.16.10.1:9997]

connection = dns
sourcetype = dns
[any://172.16.10.1:10001]

connection_host = ip
sourcetype = web
[tcp://172.16.10.1:9997]

connection_host = web
sourcetype = web
[tcp://172.16.10.1:10001]

connection_host = dns
sourcetype = dns

NO.61 Which layers are involved in Splunk configuration file layering? (select all that apply)

App context

User context

Global context

Forwarder context

NO.62 Which of the following are methods for adding inputs in Splunk? (Select all that apply.)

CLI

Splunk Web

Editing inpits.conf

Editing monitor.conf

NO.63 Where are license files stored?

$SPLUNK_HOME/etc/secure

$SPLUNK_HOME/etc/system

$SPLUNK_HOME/etc/licenses

$SPLUNK_HOME/etc/apps/licenses

NO.64 All search-time field extractions should be specified on which Splunk component?

Deployment server

Universal forwarder

Indexer

Search head

NO.65 How is a remote monitor input distributed to forwarders?

As an app.

As a forward.conf file.

As a monitor.conf file.

As a forwarder monitor profile.

NO.66 You update a props. conf file while Splunk is running. You do not restart Splunk and you run this command:
splunk btoo1 props list -debug. What will the output be?

list of all the configurations on-disk that Splunk contains.

A verbose list of all configurations as they were when splunkd started.

A list of props. conf configurations as they are on-disk along with a file path from which the configuration is located

A list of the current running props, conf configurations along with a file path from which the configuration was made

NO.67 What action is required to enable forwarder management in Splunk Web?

Navigate to Settings > Server Settings > General Settings, and set an App server port.

Navigate to Settings > Forwarding and receiving, and click on Enable Forwarding.

Create a server class and map it to a client in SPLUNK_HOME/etc/system/local/serverclass.conf.

Place an app in the SPLUNK_HOME/etc/deployment-apps directory of the deployment server.

NO.68 Which additional component is required for a search head cluster?

Deployer

Cluster Master

Monitoring Console

Management Console

NO.69 A non-clustered Splunk environment has three indexers (A,B,C) and two search heads (X, Y). During a search executed on search head X, indexer A crashes. What is Splunk’s response?

Update the user in Splunk web informing them that the results of their search may be incomplete.

Repeat the search request on indexer B without informing the user.

Update the user in Splunk web that their results may be incomple and that Splunk will try to re-execute the search.

Inform the user in Splunk web that their results may be incomplete and have them attempt the search from search head Y.

NO.70 Which authentication methods are natively supported within Splunk Enterprise? (select all that apply)

LDAP

SAML

RADIUS

Duo Multifactor Authentication

[UPDATED 2023] Read SPLK-1003 Study Guide Cover to Cover as Literally [Q47-Q70]

Be the first to reply

Leave a Reply Cancel reply