Splunk Splunk Certifications SPLK-3003 Questions & Answers

• Question 51:

  What does Splunk do when it indexes events?

  A. Extracts the top 10 fields.

  B. Extracts metadata fields such as host, source, sourcetype.

  C. Performs parsing, merging, and typing processes on universal forwarders.

  D. Create report acceleration summaries.

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/ Howindexingworks#:~:text=Splunk%20Enterprise%20can%20index%20any,events%20indexes%20and% 20metrics%20indexes

• Question 52:

  What happens when an index cluster peer freezes a bucket?

  A. All indexers with a copy of the bucket will delete it.

  B. The cluster master will ensure another copy of the bucket is made on the other peers to meet the replication settings.

  C. The cluster master will no longer perform fix-up activities for the bucket.

  D. All indexers with a copy of the bucket will immediately roll it to frozen.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Bucketsandclusters

• Question 53:

  A customer has the following Splunk instances within their environment: An indexer cluster consisting of a cluster master/master node and five clustered indexers, two search heads (no search head clustering), a deployment server, and a license master. The deployment server and license master are running on their own single-purpose instances. The customer would like to start using the Monitoring Console (MC) to monitor the whole environment.

  On the MC instance, which instances will need to be configured as distributed search peers by specifying them via the UI using the settings menu?

  A. Just the cluster master/master node.

  B. Indexers, search heads, deployment server, license master, cluster master/master node.

  C. Search heads, deployment server, license master, cluster master/master node

  D. Deployment server, license master

  Correct Answer: C

• Question 54:

  The data in Splunk is now subject to auditing and compliance controls. A customer would like to ensure that at least one year of logs are retained for both Windows and Firewall events. What data retention controls must be configured?

  A. maxTotalDataSizeMB and frozenTimePeriodInSecs

  B. coldToFrozenDir and coldToFrozenScript

  C. Splunk Volume and maxTotalDataSizMB

  D. Splunk Volume and frozenTimePeriodInSecs

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Setaretirementandarchivingpolicy

• Question 55:

  Data can be onboarded using apps, Splunk Web, or the CLI. Which is the PS preferred method?

  A. Create UDP input port 9997 on a UF.

  B. Use the add data wizard in Splunk Web.

  C. Use the inputs.conf file.

  D. Use a scripted input to monitor a log file.

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Data/Howdoyouwanttoadddata

• Question 56:

  Which of the following statements applies to indexer discovery?

  A. The Cluster Master (CM) can automatically discover new indexers added to the cluster.

  B. Forwarders can automatically discover new indexers added to the cluster.

  C. Deployment servers can automatically configure new indexers added to the cluster.

  D. Search heads can automatically discover new indexers added to the cluster.

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/DistSearch/ Connectclustersearchheadstosearchpeers

• Question 57:

  How could a role in which all users must specify an index=clause in all searches be configured?

  A. Set the authorize.conf setting: srchIndexesDefault to no value.

  B. Set the authorize.conf setting: srchFilter to no value.

  C. Set the authorize.conf setting: srchIndexesAllowed to no value.

  D. Set the authorize.conf setting: srchJobsQuota to no value.

  Correct Answer: B

• Question 58:

  In which of the following scenarios should base configurations be used to provide consistent, repeatable, and supportable configurations?

  A. For non-production environments to keep their configurations in sync.

  B. To ensure every customer has exactly the same base settings.

  C. To provide settings that do not need to be customized to meet customer requirements.

  D. To provide settings that can be customized to meet customer requirements.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Wheretofindtheconfigurationfiles

• Question 59:

  A customer has written the following search:

  

  How can the search be rewritten to maximize efficiency?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: C

• Question 60:

  Consider the scenario where the /var/log directory contains the files secure, messages, cron, audit. A customer has created the following inputs.conf stanzas in the same Splunk app in order to attempt to monitor the files secure and messages:

  

  Which file(s) will actually be actively monitored?

  A. /var/log/secure B. /var/log/messages

  C. /var/log/messages, /var/log/cron, /var/log/audit, /var/log/secure

  D. /var/log/secure, /var/log/messages

  Correct Answer: A