Splunk Splunk Certifications SPLK-2001 Questions & Answers

• Question 11:

  Which of the following is an intended use of HTTP Event Collector tokens?

  A. A cookie.

  B. An HTTP header field.

  C. A JSON field in the HTTP request.

  D. A password in conjunction with login.

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/ FormateventsforHTTPEventCollector

• Question 12:

  When the search/jobs REST endpoint is called to execute a search, what can be done to reduce the results size in the results? (Select all that apply.)

  A. Use a generating search.

  B. Remove unneeded fields.

  C. Truncate the data, using selective functions.

  D. Summarize data, using analytic commands.

  Correct Answer: AB

• Question 13:

  Which of the following is a customization option for the Open in Search panel link button?

  A. Display the refresh time.

  B. Show the Export Results button.

  C. Show link buttons at the bottom of a panel.

  D. Define an alternative search or target view to use.

  Correct Answer: D

• Question 14:

  Which items below are configured in inputs.conf? (Select all that apply.)

  A. A modular input written in Python.

  B. A file input monitoring a JSON file.

  C. A custom search command written in Python.

  D. An HTTP Event Collector as receiver of data from an app.

  Correct Answer: AD

• Question 15:

  Which of the following statements describe an HEC token? (Select all that apply.)

  A. Maps to a Splunk user.

  B. Can be used to download data.

  C. Is a GUID (globally unique identifier).

  D. Can be created in Splunk Web or using REST endpoints.

  Correct Answer: CD

• Question 16:

  Which of the following ensures that quotation marks surround the value referenced by the token?

  A. $token_name|s$

  B. "$token_name$"

  C. ($token_name$)

  D. \"$token_name$\"

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/tokens

• Question 17:

  Which of the following are security best practices for Splunk app development? (Select all that apply.)

  A. Store passwords in clear text in .conf files.

  B. Implement security in software development lifecycle.

  C. Manually test application with the controls listed in the OWASP Security Testing Guide.

  D. Use a dynamic scanner such as OWASP ZAP to scan web application components for vulnerabilities.

  Correct Answer: CD

  Reference: https://dev.splunk.com/enterprise/docs/developapps/testvalidate/securitybestpractices/

• Question 18:

  Log files related to Splunk REST calls can be found in which indexes? (Select all that apply.)

  A. _audit

  B. _internal

  C. _thefishbucket

  D. _blocksignature

  Correct Answer: AB

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Troubleshooting/Whatdatagetslogged

• Question 19:

  A fellow Splunk administrator is reviewing an app that has been downloaded from splunkbase and

  deployed in an organization. The admin has e-mailed the following configuration snippet with a brief note

  that says "fix the permissions".

  In what configuration file should the snippet be placed?

  []

  access = read : [ * ], write : [ admin ]

  export - system

  (Assume that $APP_HOME refers to the path that the app is installed, e.g. $SPLUNK_HOME/etc/apps/

  )

  A. $APP_HOME/default/app.conf

  B. $APP_HOME/local/default.meta

  C. $APP_HOME/metadata/local.meta

  D. $SPLUNK_HOME/etc/system/local/server.conf

  Correct Answer: D

• Question 20:

  Given a dashboard with a Simple XML extension in myApp, what is the XML reference for the file myJS.js located in myOtherApp in the location shown below?

  $SPLUNK_HOME/etc/apps/myOtherApp/appserver/static/javascript/

  A.

  B.

  C.

  D.

  Correct Answer: A

  Reference: https://dev.splunk.com/enterprise/docs/developapps/visualizedata/usewebframework/ modifydashboards/