Splunk SPLK-1003 Online Practice Questions and Exam Preparation

Splunk SPLK-1003 Online Questions & Answers

• Question 141:

  Which of the following types of data count against the license daily quota?

  A. Replicated data
  B. splunkd logs
  C. Summary index data
  D. Windows internal logs
  D. Windows internal logs

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.0.3/Admin/Distdeploylicenses#Clustered_ deployments_and_licensing_issues

  Reference:https://community.splunk.com/t5/Deployment-Architecture/License-usage-in- Indexer-Cluster/m-p/493548

• Question 142:

  In inputs. conf, which stanza would mean Splunk was only reading one local file?

  A. [read://opt/log/crashlog/Jan27crash.txt]
  B. [monitor::/ opt/log/crashlog/Jan27crash.txt]
  C. [monitor:/// opt/log/]
  D. [monitor:/// opt/log/ crashlog/Jan27crash.txt]
  B. [monitor::/ opt/log/crashlog/Jan27crash.txt]

  ---

  Explanation/Reference:

  [monitor::/opt/log/crashlog/Jan27crash.txt]. This stanza means that Splunk is monitoring a single local file named Jan27crash.txt in the /opt/log/crashlog/ directory1. The monitor input type is used to monitor files and directories for changes and index any new data that is added2.

• Question 143:

  Which feature in Splunk allows Event Breaking, Timestamp extractions, and any advanced configurations found in props.conf to be validated all through the UI?

  A. Apps
  B. Search
  C. Data preview
  D. Forwarder inputs
  C. Data preview

  ---

  Explanation/Reference:

  http://www.splunk.com/view/SP-CAAAGPR

• Question 144:

  Which network input option provides durable file-system buffering of data to mitigate data loss due to network outages and splunkd restarts?

  A. diskQueueSize
  B. durableQueueSize
  C. persistentOueueSize
  D. queueSize
  C. persistentOueueSize

  ---

  Explanation/Reference:

  Reference:https://docs.splunk.com/Documentation/SplunkCloud/8.2.2111/Data/Usepersistentqueues

• Question 145:

  An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the defaultprops.confbelow, whichSPLUNK_HOME/etc/ users/buttercup/myTA/local/props.confstanza can be added to the user's local context to disable the field aliases?

  

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  B. Option B

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/latest/Admin/Howtoeditaconfigurationfile#Clear%20a%20setting

• Question 146:

  Which of the following are available input methods when adding a file input in Splunk Web? (Choose all that apply.)

  A. Index once.
  B. Monitor interval.
  C. On-demand monitor.
  D. Continuously monitor.
  A. Index once.
  D. Continuously monitor.

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/Howdoyouwanttoadddata The fastest way to add data to your Splunk Cloud instance or Splunk Enterprise deployment is to use Splunk Web. After you access the Add Data page, choose one of three options for getting data into your Splunk platform deployment with Splunk Web: (1) Upload, (2) Monitor, (3) Forward The Upload option lets you upload a file or archive of files for indexing. When you choose Upload option, Splunk Web opens the upload process page. Monitor. For Splunk Enterprise installations, the Monitor option lets you monitor one or more files, directories, network streams, scripts, Event Logs (on Windows hosts only), performance metrics, or any other type of machine data that the Splunk Enterprise instance has access to.

• Question 147:

  Consider a company with a Splunk distributed environment in production. The Compliance Department wants to start using Splunk; however, they want to ensure that no one can see their reports or any other knowledge objects. Which Splunk Component can be added to implement this policy for the new team?

  A. Indexer
  B. Deployment server
  C. Universal forwarder
  D. Search head
  D. Search head

• Question 148:

  TheLINE_BREAKERattribute is configured in which configuration file?

  A. props.conf
  B. indexes.conf
  C. inpucs.conf
  D. transforms.conf
  A. props.conf

  ---

  Explanation/Reference:

  Reference:https://docs.splunk.com/Documentation/SplunkCloud/8.2.2105/Data/Configuree ventlinebreaking

• Question 149:

  A Splunk administrator has been tasked with developing a retention strategy to have frequently accessed data sets on SSD storage and to have older, less frequently accessed data on slower NAS storage. They have set a mount point for the NAS. Which parameter do they need to modify to set the path for the older, less frequently accessed data in indexes.conf?

  A. homepath
  B. thawedPath
  C. summaryHomePath
  D. colddeath
  D. colddeath

  ---

  Explanation/Reference:

  The coldPath parameter defines the path for the cold buckets, which are the oldest and least frequently accessed data in an index. By setting the coldPath to point to the NAS mount point, the Splunk administrator can achieve the retention strategy of having older data on slower NAS storage.

• Question 150:

  How often does Splunk recheck the LDAP server?

  A. Every 5 minutes
  B. Each time a user logs in
  C. Each time Splunk is restarted
  D. Varies based on LDAP_refresh setting.
  B. Each time a user logs in

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.0.6/Security/ManageSplunkuserroleswith LDAP