Splunk Splunk Certifications SPLK-1003 Questions & Answers

• Question 91:

  Which of the following authentication types requires scripting in Splunk?

  A. ADFS

  B. LDAP

  C. SAML

  D. RADIUS

  Correct Answer: D

  https://answers.splunk.com/answers/131127/scripted-authentication.html Scripted Authentication: An option for Splunk Enterprise authentication. You can use an authentication system that you have in place (such as PAM or RADIUS) by configuring authentication.conf to use a script instead of using LDAP or Splunk Enterprise default authentication.

• Question 92:

  Which of the following statements accurately describes using SSL to secure the feed from a forwarder?

  A. It does not encrypt the certificate password.

  B. SSL automatically compresses the feed by default.

  C. It requires that the forwarder be set to compressed=true.

  D. It requires that the receiver be set to compression=true.

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/AboutsecuringyourSplunkconfigurationwithSSL

• Question 93:

  Which setting allows the configuration of Splunk to allow events to span over more than one line?

  A. SHOULD_LINEMERGE = true

  B. BREAK_ONLY_BEFORE_DATE = true

  C. BREAK_ONLY_BEFORE =

  D. SHOULD_LINEMERGE = false

  Correct Answer: A

  The setting that allows the configuration of Splunk to allow events to span over more than one line is SHOULD_LINEMERGE. This setting determines whether consecutive lines from a single source should be concatenated into a single event. If SHOULD_LINEMERGE is set to true, Splunk will attempt to merge multiple lines into one event based on certain criteria, such as timestamps or regular expressions. Therefore, option A is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [Configure event line merging - Splunk Documentation]

• Question 94:

  Which of the following statements describe deployment management? (select all that apply)

  A. Requires an Enterprise license

  B. Is responsible for sending apps to forwarders.

  C. Once used, is the only way to manage forwarders

  D. Can automatically restart the host OS running the forwarder.

  Correct Answer: AB

  https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Distdeploylicenses#:~:text=Lic ense%20requirements,do%20not%20index%20external%20data.

  "All Splunk Enterprise instances functioning as management components needs access to an Enterprise license. Management components include the deployment server, the indexer cluster manager node, the search head cluster deployer, and the monitoring console."

  https://docs.splunk.com/Documentation/Splunk/8.2.2/Updating/Aboutdeploymentserver

  "The deployment server is the tool for distributing configurations, apps, and content updates to groups of Splunk Enterprise instances."

• Question 95:

  What hardware attribute would need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?

  A. Disk

  B. CPUs

  C. Memory

  D. Network interface cards

  Correct Answer: B

  https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/SHCarchitecture Scroll down to section titled, How the cluster handles concurrent search quotas, "Overall search quota. This quota determines the maximum number of historical searches (combined scheduled and ad hoc) that the cluster can run concurrently. This quota is configured with max_Searches_per_cpu and related settings in limits.conf."

• Question 96:

  Which of the following are reasons to create separate indexes? (Choose all that apply.)

  A. Different retention times.

  B. Increase number of users.

  C. Restrict user permissions.

  D. File organization.

  Correct Answer: AC

  Reference:https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-have- multiple-indexes/m-p/12063

  Different retention times: You can set different retention policies for different indexes, depending on how long you want to keep the data. For example, you can have an index for security data that has a longer retention time than an index for performance data that has a shorter retention time.

  Restrict user permissions: You can set different access permissions for different indexes, depending on who needs to see the data. For example, you can have an index for sensitive data that is only accessible by certain users or roles, and an index for public data that is accessible by everyone.

• Question 97:

  What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?

  A. REGEX, DEST. FORMAT

  B. REGEX.SRC_KEY, FORMAT

  C. REGEX, DEST_KEY, FORMAT

  D. REGEX, DEST_KEY FORMATTING

  Correct Answer: C

  REGEX =

  *

  Enter a regular expression to operate on your data.

  FORMAT =

  *

  NOTE: This option is valid for both index-time and search-time field extraction. Index-time field extraction configuration require the FORMAT settings. The FORMAT settings is optional for search-time field extraction configurations.

  *

  This setting specifies the format of the event, including any field names or values you want to add.

  DEST_KEY =

  *

  NOTE: This setting is only valid for index-time field extractions.

  *

  Specifies where SPLUNK software stores the expanded FORMAT results in accordance with the REGEX match.

• Question 98:

  Which optional configuration setting in inputs .conf allows you to selectively forward the data to specific indexer(s)?

  A. _TCP_ROUTING

  B. _INDEXER_LIST

  C. _INDEXER_GROUP

  D. _INDEXER ROUTING

  Correct Answer: A

  https://docs.splunk.com/Documentation/Splunk/7.0.3/Forwarding/Routeandfilterdatad#Perf orm_selective_indexing_and_forwarding Specifies a comma-separated list of tcpout group names. Use this setting to selectively forward your data to specific indexers by specifying the tcpout groups that the forwarder should use when forwarding the data. Define the tcpout group names in the outputs.conf file in [tcpout:] stanzas. The groups present in defaultGroup in [tcpout] stanza in the outputs.conf file.

• Question 99:

  When does a warm bucket roll over to a cold bucket?

  A. When Splunk is restarted.

  B. When the maximum warm bucket age has been reached.

  C. When the maximum warm bucket size has been reached.

  D. When the maximum number of warm buckets is reached.

  Correct Answer: D

  https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/HowSplunkstoresindexes Once further conditions are met (for example, the index reaches some maximum number of warm buckets), the indexer begins to roll the warm buckets to cold, based on their age. It alwaysselects the oldest warm bucket to roll to cold. Buckets continue to roll to cold as they age in this manner. Cold buckets reside in a different location from hot and warm buckets. You can configure the location so that cold buckets reside on cheaper storage.

  Reference: https://community.splunk.com/t5/Deployment-Architecture/Rolling-Hot-Data-to- to-Cold-quicker/tdp/166653

• Question 100:

  The volume of data from collecting log files from 50 Linux servers and 200 Windows servers will require multiple indexers. Following best practices, which types of Splunk component instances are needed?

  A. Indexers, search head, universal forwarders, license master

  B. Indexers, search head, deployment server, universal forwarders

  C. Indexers, search head, deployment server, license master, universal forwarder

  D. Indexers, search head, deployment server, license master, universal forwarder, heavy forwarder

  Correct Answer: C

  Indexers, search head, deployment server, license master, universal forwarder. This is the combination of Splunk component instances that are needed to handle the volume of data from collecting log files from 50 Linux servers and 200 Windows servers, following the best practices. The roles and functions of these components are: Indexers: These are the Splunk instances that index the data and make it searchable. They also perform some data processing, such as timestamp extraction, line breaking, and field extraction. Multiple indexers can be clustered together to provide high availability, data replication, and load balancing. Search head: This is the Splunk instance that coordinates the search across the indexers and merges the results from them. It also provides the user interface for searching, reporting, and dashboarding. A search head can also be clustered with other search heads to provide high availability, scalability, and load balancing. Deployment server: This is the Splunk instance that manages the configuration and app deployment for the universal forwarders. It allows the administrator to centrally control the inputs.conf, outputs.conf, and other configuration files for the forwarders, as well as distribute apps and updates to them. License master: This is the Splunk instance that manages the licensing for the entire Splunk deployment. It tracks the license usage of all the Splunk instances and enforces the license limits and violations. It also allows the administrator to add, remove, or change licenses. Universal forwarder: These are the lightweight Splunk instances that collect data from various sources and forward it to the indexers or other forwarders. They do not index or parse the data, but only perform minimal processing, such as compression and encryption. They are installed on the Linux and Windows servers that generate the log files.