Splunk Splunk Certifications SPLK-1003 Questions & Answers

• Question 111:

  Which of the following methods will connect a deployment client to a deployment server? (select all that apply)

  A. Run $SPLUNK_ROME/bin/ splunk set deploy-poll : from the command line of the deployment client.

  B. Create and edit a deploymentserver . conf file in SSPLVNE{ on the deployment server.

  C. Create and edit a deploymentclient . conf file in SSPLTJNE( EOME/etc/ system/local on the deployment client.

  D. Run $SPLUNK ROME/bin/spiunk set deploy-poi i : from the command line of the deployment server.

  Correct Answer: AC

  The correct methods to connect a deployment client to a deployment server are A and C. You can either run the command splunk set deploy-poll : from the command line of the deployment client1 or create and edit a deploymentclient.conf file in $SPLUNK_HOME/etc/system/local on the deployment client2. Both methods require you to specify the IP address, hostname, and management port of the deployment server that you want the client to connect to.

• Question 112:

  When are knowledge bundles distributed to search peers?

  A. After a user logs in.

  B. When Splunk is restarted.

  C. When adding a new search peer.

  D. When a distributed search is initiated.

  Correct Answer: D

  "The search head replicates the knowledge bundle periodically in the background or when initiating a search. " "As part of the distributed search process, the search head replicates and distributes its knowledge objects to its search peers, or indexers. Knowledge objects include saved searches, event types, and other entities used in searching accorss indexes. The search head needs to distribute this material to its search peers so that they can properly execute queries on its behalf."

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/DistSearch/Whatsearchheadssend

• Question 113:

  What is the difference between the two wildcards ... and - for the monitor stanza in inputs, conf?

  A. ... is not supported in monitor stanzas

  B. There is no difference, they are interchangable and match anything beyond directory boundaries.

  C. * matches anything in that specific directory path segment, whereas ... recurses through subdirectories as well.

  D. ... matches anything in that specific directory path segment, whereas - recurses through subdirectories as well.

  Correct Answer: C

  The ellipsis wildcard searches recursively through directories and any number of levels of subdirectories to find matches. If you specify a folder separator (for example, //var/log/.../file), it does not match the first folder level, only subfolders.

  * The asterisk wildcard matches anything in that specific folder path segment. Unlike ..., * does not recurse through subfolders.

• Question 114:

  A company moves to a distributed architecture to meet the growing demand for the use of Splunk. What parameter can be configured to enable automatic load balancing in the

  Universal Forwarder to send data to the indexers?

  A. Create one outputs . conf file for each of the server addresses in the indexing tier.

  B. Configure the outputs . conf file to point to any server in the indexing tier and Splunk will configure the data to be sent to all of the indexers.

  C. Splunk does not do load balancing and requires a hardware load balancer to balance traffic across the indexers.

  D. Set the stanza to have a server value equal to a comma-separated list of IP addresses and indexer ports for each of the indexers in the environment.

  Correct Answer: D

  Set the stanza to have a server value equal to a comma-separated list of IP addresses and indexer ports for each of the indexers in the environment. This is explained in the Splunk documentation, which states: To enable automatic load balancing, set the stanza to have a server value equal to a comma-separated list of IP addresses and indexer ports for each of the indexers in the environment. For example:

  [tcpout] server=10.1.1.1:9997,10.1.1.2:9997,10.1.1.3:9997 The forwarder then distributes data across all of the indexers in the list.

• Question 115:

  Which default Splunk role could be assigned to provide users with the following capabilities?

  Create saved searches

  Edit shared objects and alerts

  Not allowed to create custom roles

  A. admin

  B. power

  C. user

  D. splunk-system-role

  Correct Answer: B

  The power role is a default Splunk role that grants users the ability to create saved searches, edit shared objects and alerts, and access advanced search commands. However, the power role does not allow users to create custom roles, which is a privilege reserved for the admin role. Therefore, option B is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [About configuring role-based user access - Splunk Documentation]

• Question 116:

  What is the correct order of steps in Duo Multifactor Authentication?

  A. 1 Request Login

  2. Connect to SAML server

  3 Duo MFA

  4 Create User session

  5 Authentication Granted 6. Log into Splunk

  B. 1. Request Login 2 Duo MFA

  3. Authentication Granted 4 Connect to SAML server

  5.

  Log into Splunk

  6.

  Create User session

  C. 1 Request Login 2 Check authentication / group mapping 3 Authentication Granted

  4.

  Duo MFA

  5.

  Create User session

  6.

  Log into Splunk

  D. 1 Request Login 2 Duo MFA

  3. Check authentication / group mapping

  4 Create User session

  5. Authentication Granted

  6 Log into Splunk

  Correct Answer: C

  Using the provided DUO/Splunk reference URLhttps://duo.com/docs/splunk

  Scroll down to the Network Diagram section and note the following 6 similar steps 1 - SPlunk connection initiated 2 - Primary authentication 3 - Splunk connection established to Duo Security over TCP port 443 4 - Secondary authentication via Duo Security's service 5 - Splunk receives authentication response 6 - Splunk session logged in.

• Question 117:

  When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

  A. App Class

  B. Client Class

  C. Server Class

  D. Forwarder Class

  Correct Answer: C

  https://docs.splunk.com/Splexicon:Serverclass

• Question 118:

  Which artifact is required in the request header when creating an HTTP event?

  A. ackID

  B. Token

  C. Manifest

  D. Host name

  Correct Answer: B

  Reference:https://docs.splunk.com/Documentation/Splunk/8.2.3/Data/FormateventsforHTT PEventCollector

  When creating an HTTP event, the request header must include a token that identifies the HTTP Event Collector (HEC) endpoint. The token is a 32-character hexadecimal string that is generated when the HEC endpoint is created. The token is used to authenticate the request and route the event data to the correct index. Therefore, option B is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [About HTTP Event Collector - Splunk Documentation]

• Question 119:

  An index stores its data in buckets. Which default directories does Splunk use to store buckets? (Choose all that apply.)

  A. bucketdb

  B. frozendb

  C. colddb

  D. db

  Correct Answer: CD

  Reference: https://wiki.splunk.com/Deploy:BucketRotationAndRetention

• Question 120:

  Which file will be matched for the following monitor stanza in inputs. conf?

  [monitor: ///var/log/*/bar/*. txt]

  A. /var/log/host_460352847/temp/bar/file/csv/foo.txt

  B. /var/log/host_460352847/bar/foo.txt

  C. /var/log/host_460352847/bar/file/foo.txt

  D. /var/ log/ host_460352847/temp/bar/file/foo.txt

  Correct Answer: C

  The correct answer is C. /var/log/host_460352847/bar/file/foo.txt. The monitor stanza in inputs.conf is used to configure Splunk to monitor files and directories for new data.The monitor stanza has the following syntax1:

  [monitor://]

  The input path can be a file or a directory, and it can include wildcards (*) and regular expressions. The wildcards match any number of characters, including none, while the regular expressions match patterns of characters.The input path is

  case-sensitive and must be enclosed in double quotes if it contains spaces1. In this case, the input path is /var/log//bar/.txt, which means Splunk will monitor any file with the .txt extension that is located in a subdirectory named bar under the /

  var/log directory.The subdirectory bar can be at any level under the /var/log directory, and the * wildcard will match any characters before or after the bar and .txt parts1. Therefore, the file /var/log/host_460352847/bar/file/foo.txt will be

  matched by the monitor stanza, as it meets the criteria. The other files will not be matched, because:

  A. /var/log/host_460352847/temp/bar/file/csv/foo.txt has a .csv extension, not a .txt extension.

  B. /var/log/host_460352847/bar/foo.txt is not located in a subdirectory under the bar directory, but directly in the bar directory. D. /var/log/host_460352847/temp/bar/file/foo.txt is located in a subdirectory named file under the bar directory, not directly in the bar directory.