Skip to main content

SPLK-1003 Real Exam Questions

Splunk Enterprise Certified Admin

182 questions available · Page 1 of 19

Updated Exam DumpsVerified AnswersPass Guarantee

Get Complete Exam Dumps
Question 1 Single choice

What conf file needs to be edited to set up distributed search groups?

  1. A

    props.conf

  2. B

    search.conf

  3. C

    distsearch.conf

  4. D

    distibutedsearch.conf

Show answer and explanation

Correct answer: C

Explanation

"You can group your search peers to facilitate searching on a subset of them. Groups of search peers are known as "distributed search groups." You specify distributed search groups in the distsearch.conf file"

References:
https://docs.splunk.com/Documentation/Splunk/8.0.5/DistSearch/Distributedsearchgroups

Question 2 Single choice

Which default Splunk role could be assigned to provide users with the following capabilities?

Create saved searches

Edit shared objects and alerts

Not allowed to create custom roles

  1. A

    admin

  2. B

    power

  3. C

    user

  4. D

    splunk-system-role

Show answer and explanation

Correct answer: B

Explanation

The power role is a default Splunk role that grants users the ability to create saved searches, edit shared objects and alerts, and access advanced search commands. However, the power role does not allow users to create custom roles, which is a privilege reserved for the admin role. Therefore, option B is the correct answer.
References:
Splunk Enterprise Certified Admin | Splunk, [About configuring role-based
user access - Splunk Documentation]

Question 3 Multiple choice

What is required when adding a native user to Splunk? (select all that apply)

  1. A

    Password

  2. B

    Username

  3. C

    Full Name

  4. D

    Default app

Show answer and explanation

Correct answers: A, B

Explanation

According to the Splunk system admin course PDF, When adding native users, Username and Password
ARE REQUIRED

Question 4 Single choice

Immediately after installation, what will a Universal Forwarder do first?

  1. A

    Automatically detect any indexers in its subnet and begin routing data.

  2. B

    Begin reading local files on its server.

  3. C

    Begin generating internal Splunk logs.

  4. D

    Send an email to the operator that the installation process has completed.

Show answer and explanation

Correct answer: C

Explanation

Begin generating internal Splunk logs. Immediately after installation, a Universal Forwarder will start generating internal Splunk logs that contain information about its own operation, such as startup and shutdown events, configuration changes, data ingestion, and forwarding activities. These logs are stored in the $SPLUNK_HOME/var/log/splunk directory on the Universal Forwarder machine.

Question 5 Single choice

Where are license files stored?

  1. A

    $SPLUNK_HOME/etc/secure

  2. B

    $SPLUNK_HOME/etc/system

  3. C

    $SPLUNK_HOME/etc/licenses

  4. D

    $SPLUNK_HOME/etc/apps/licenses

Show answer and explanation

Correct answer: C

Question 6 Single choice

Which Splunk component does a search head primarily communicate with?

  1. A

    Indexer

  2. B

    Forwarder

  3. C

    Cluster master

  4. D

    Deployment server

Show answer and explanation

Correct answer: A

Question 7 Single choice

The CLI command splunk add forward-server indexer:<receiving-port> will create stanza(s) in which configuration file?

  1. A

    inputs.conf

  2. B

    indexes.conf

  3. C

    outputs.conf

  4. D

    servers.conf

Show answer and explanation

Correct answer: C

Explanation

The CLI command "Splunk add forward-server indexer:<receiving-port>" is used to define the indexer and the listening port on forwards. The command creates this kind of entry "[tcpout-server://<ip
address>:<port>]" in the outputs.conf file.
https://docs.splunk.com/Documentation/Forwarder/8.2.2/Forwarder/Configureforwardingwit
houtputs.conf

References:
https://docs.splunk.com/Documentation/Forwarder/8.0.5/Forwarder/Enableareceiver

Question 8 Single choice

A log file contains 193 days worth of timestamped events.

Which monitor stanza would be used to collect data 45 days old and newer from that log file?

  1. A

    followTail = -45d

  2. B

    ignore = 45d

  3. C

    includeNewerThan = -35d

  4. D

    ignoreOlderThan = 45d

Show answer and explanation

Correct answer: D

Explanation

References:
https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Configuretimestampr
ecognition

Question 9 Multiple choice

The universal forwarder has which capabilities when sending data? (select all that apply)

  1. A

    Sending alerts

  2. B

    Compressing data

  3. C

    Obfuscating/hiding data

  4. D

    Indexer acknowledgement

Show answer and explanation

Correct answers: B, D

Explanation

https://docs.splunk.com/Documentation/Splunk/8.0.1/Forwarding/Aboutforwardingandreceivingdata
https://docs.splunk.com/Documentation/Forwarder/8.1.1/Forwarder/Configureforwardingwithoutputs.conf#:~:text=compressed%3Dtrue%20This%20tells%20the,the%20forwarder%20sends%20raw%20data.

Question 10 Multiple choice

Which of the following indexes come pre-configured with Splunk Enterprise? (select all that apply)

  1. A

    _license

  2. B

    _lnternal

  3. C

    _external

  4. D

    _thefishbucket

Show answer and explanation

Correct answers: B, D

Explanation

https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Howindexingworks