Splunk Splunk Certifications SPLK-2001 Questions & Answers

• Question 61:

  What must be done when calling the serviceNS endpoint?

  A. Authenticate with an admin user.

  B. Specify the user and app context in the URI.

  C. Authenticate with the user of the required context.

  D. Pass the user and app context in the request payload.

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/RESTUM/RESTusing

• Question 62:

  Which of the following are characteristics of an add-on? (Select all that apply.)

  A. Requires navigation file.

  B. Occupies a unique namespace within Splunk.

  C. Can depend on add-ons for correct operation.

  D. Contains technology or components not intended for reuse by other apps.

  Correct Answer: AD

• Question 63:

  Which of the following statements describe oneshot searches? (Select all that apply.)

  A. Are always executed asynchronously.

  B. Can specify csv as an output format.

  C. Stream all results upon search completion.

  D. Can use auto_cancel to set a timeout limit.

  Correct Answer: BC

  Reference: https://dev.splunk.com/enterprise/docs/devtools/java/sdk-java/howtousesdkjava/ howtoworkjobjava/

• Question 64:

  After updating a dashboard in myApp, a Splunk admin moves myApp to a different Splunk instance. After logging in to the new instance, the dashboard is not seen. What could have happened? (Select all that apply.)

  A. The dashboard's permissions were set to private.

  B. User role permissions are different on the new instance.

  C. The admin deleted the myApp/local directory before packaging.

  D. Changes were placed in: $SPLUNK_HOME/etc/apps/search/default/data/ui/nav

  Correct Answer: AB

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/DashboardPermissions

• Question 65:

  Which of the following statements define a namespace?

  A. The namespace is a combination of the user and the app.

  B. The namespace is a combination of the user, the app, and the role.

  C. The namespace is a combination of the user, the app, the role, and the sharing level.

  D. The namespace is a combination of the user, the app, the role, the sharing level, and the permissions.

  Correct Answer: A

• Question 66:

  How can indexer acknowledgement be enabled for HTTP Event Collector (HEC)? (Select all that apply.)

  A. No need to do anything, it is turned on by default.

  B. When a REST request is sent to create a token, the property for indexer acknowledgement must be set to 1.

  C. When a new HEC token is created in Splunk Web, select the checkbox labeled "Enable indexer acknowledgement".

  D. When the Global Settings for HEC are updated in Splunk Web, select the checkbox labeled "Enable indexer acknowledgement".

  Correct Answer: CD

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/UsetheHTTPEventCollector

• Question 67:

  Which of the following are ways to get a list of search jobs? (Select all that apply.)

  A. Access Activity > Jobs with Splunk Web.

  B. Use Splunk REST to query the /services/search/jobs endpoint.

  C. Use Splunk REST to query the /services/saved/searches endpoint.

  D. Use Splunk REST to query the /services/search/sid/results endpoint.

  Correct Answer: AB

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Search/SupervisejobswiththeJobspage

• Question 68:

  Which of the following are benefits from using Simple XML Extensions? (Select all that apply.)

  A. Add custom layouts.

  B. Add custom graphics.

  C. Add custom behaviors.

  D. Limit Splunk license consumption based on host.

  Correct Answer: AC

  Reference: https://dev.splunk.com/enterprise/docs/developapps/visualizedata/usewebframework/ modifydashboards/

• Question 69:

  When updating a knowledge object via REST, which of the following are valid values for the sharing Access Control List property?

  A. App

  B. User

  C. Global

  D. Nobody

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/RESTUM/RESTusing

• Question 70:

  Suppose the following query in a Simple XML dashboard returns a table including hyperlinks:

  index news sourcetype web_proxy | table sourcetype title link

  Which of the following is a valid dynamic drilldown element to allow a user of the dashboard to visit the

  hyperlinks contained in the link field?

  A. $row.link$

  B. $$row.link$$

  C. $row.link|n$

  D. http://localhost:8000/debug/refresh

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/ BuildandeditdashboardswithSimplifiedXML