Splunk Splunk Certifications SPLK-2001 Questions & Answers

• Question 51:

  Which of the following is an example of a Splunk KV store use case? (Select all that apply.)

  A. Stores checkpoint data for modular inputs.

  B. Tracks workflow in an incident-review system.

  C. Indexes metrics data from remote HTTP sources.

  D. Stores application state as a user interacts with an app.

  Correct Answer: AB

  Reference: https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/

• Question 52:

  How can hiding or showing a panel by clicking on a chart or a table on the same form be performed?

  A. By using vent drilldown.

  B. By using workflow action.

  C. By using contextual drilldown.

  D. By using visualization drilldown.

  Correct Answer: D

• Question 53:

  Which statements are true regarding HEC (HTTP Event Collector) tokens? (Select all that apply.)

  A. Multiple tokens can be created for use with different sourcetypes and indexes.

  B. The edit token http admin role capability is required to create a token.

  C. To create a token, send a POST request to services/collector endpoint.

  D. Tokens can be edited using the data/inputs/http/{tokenName} endpoint.

  Correct Answer: AC

• Question 54:

  In order to successfully accelerate a report, which criteria must the search meet? (Select all that apply.)

  A. Cannot use event sampling.

  B. Use a transforming command.

  C. Use a standard Splunk visualization.

  D. Commands before the first transforming command must be streamable.

  Correct Answer: ABD

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Knowledge/ Manageacceleratedsearchsummaries

• Question 55:

  Using Splunk Web to modify config settings for a shared object, a revised config file with those changes is placed in which directory?

  A. $SPLUNK_HOME/etc/apps/myApp/local

  B. $SPLUNK_HOME/etc/system/default/

  C. $SPLUNK_HOME/etc/system/local

  D. $SPLUNK_HOME/etc/apps/myApp/default

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Howtoeditaconfigurationfile

• Question 56:

  What application security best practices should be adhered to while developing an app for Splunk? (Select all that apply.)

  A. Review the OWASP Top Ten List.

  B. Store passwords in clear text in .conf files.

  C. Review the OWASP Secure Coding Practices Quick Reference Guide.

  D. Ensure that third-party libraries that the app depends on have no outstanding CVE vulnerabilities.

  Correct Answer: AC

  Reference: https://dev.splunk.com/enterprise/docs/developapps/testvalidate/securitybestpractices/

• Question 57:

  There is a global search named "global_search" defined on a form as shown below:

  index-_internal source-*splunkd.log | stats count by component, log_level

  Which of the following would be a valid post-processing search? (Select all that apply.)

  A. | tstats count

  B. sourcetype=mysourcetype

  C. stats sum(count) AS count by log level

  D. search log_level=error | stats sum(count) AS count by component

  Correct Answer: CD

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/Savedsearches

• Question 58:

  Assuming permissions are set appropriately, which REST endpoint path can be used by someone with a power user role to access information about mySearch, a saved search owned by someone with a user role?

  A. /servicesNS/-/data/saved/searches/mySearch

  B. /servicesNS/object/saved/searches/mySearch

  C. /servicesNS/search/saved/searches/mySearch

  D. /servicesNS/-/search/saved/searches/mySearch

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/RESTUM/RESTusing

• Question 59:

  Which of the following options would be the best way to identify processor bottlenecks of a search?

  A. Using the REST API.

  B. Using the search job inspector.

  C. Using the Splunk Monitoring Console.

  D. Searching the Splunk logs using index=" internal".

  Correct Answer: C

• Question 60:

  Which of the following is true of a namespace?

  A. The namespace is a type of token filter.

  B. The namespace includes an app attribute which cannot be a wildcard.

  C. The namespace filters the knowledge objects returned by the REST API.

  D. The namespace does not filter knowledge objects returned by the REST API.

  Correct Answer: D