Splunk SPLK-1003 Online Practice Questions and Exam Preparation

Splunk SPLK-1003 Online Questions & Answers

• Question 161:

  Which Splunk component performs indexing and responds to search requests from the search head?

  A. Forwarder
  B. Search peer
  C. License master
  D. Search head cluster
  B. Search peer

  ---

  Explanation/Reference:

  A Splunk platform instance that responses to search requests from a search head. The term "Search peer" is usually synonymous with the indexer role in a distributed search topology..."

• Question 162:

  What is the name of the object that stores events inside of an index?

  A. Container
  B. Bucket
  C. Data layer
  D. Indexer
  B. Bucket

  ---

  Explanation/Reference:

  A bucket is the object that stores events inside of an index. According to the Splunk documentation, "An index is a collection of directories, also called buckets, that contain index files. Each bucket represents a specific time range." A bucket can be in one of several states, such as hot, warm, cold, frozen, or thawed. Buckets are managed by indexers or clusters of indexers.

• Question 163:

  In a customer managed Splunk Enterprise environment, what is the endpoint URI used to collect data?

  A. services/collector
  B. data/collector
  C. services/inputs?raw
  D. services/data/collector
  A. services/collector

  ---

  Explanation/Reference:

  This is the endpoint URI used to collect data using the HTTP Event Collector (HEC), which is a token-based API that allows you to send data to Splunk Enterprise from any application that can make an HTTP request. The endpoint URI consists of the protocol (http or https), the hostname or IP address of the Splunk server, the port number (default is 8088), and the service name (services/collector). For example: https://mysplunkserver.example.com:8088/services/collector

• Question 164:

  The priority of layered Splunk configuration files depends on the file's:

  A. Owner
  B. Weight
  C. Context
  D. Creation time
  C. Context

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/Wheretofindtheconfigurationfil es

  "To determine the order of directories for evaluating configuration file precendence, Splunk software considers each file's context. Configuration files operate in either a global context or in the context of the current app and user"

• Question 165:

  When does a warm bucket roll over to a cold bucket?

  A. When Splunk is restarted.
  B. When the maximum warm bucket age has been reached.
  C. When the maximum warm bucket size has been reached.
  D. When the maximum number of warm buckets is reached.
  D. When the maximum number of warm buckets is reached.

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.1.1/Indexer/HowSplunkstoresindexes Once further conditions are met (for example, the index reaches some maximum number of warm buckets), the indexer begins to roll the warm buckets to cold, based on their age. It alwaysselects the oldest warm bucket to roll to cold. Buckets continue to roll to cold as they age in this manner. Cold buckets reside in a different location from hot and warm buckets. You can configure the location so that cold buckets reside on cheaper storage.

  Reference: https://community.splunk.com/t5/Deployment-Architecture/Rolling-Hot-Data-to- to-Cold-quicker/tdp/166653

• Question 166:

  Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)

  A. props.conf
  B. inputs.conf
  C. rawdata.conf
  D. transforms.conf
  A. props.conf
  D. transforms.conf

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.1.1/Knowledge/Configureadvancedextrac tionswithfieldtransforms use transformations with props.conf and transforms.conf to: Mask or delete raw data as it is being indexed verride sourcetype or host based upon event values Route events to specific indexes based on event content ?Prevent unwanted events from being indexed

  Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/Configuretimestamprecognition

• Question 167:

  Which of the following apply to how distributed search works? (select all that apply)

  A. The search head dispatches searches to the peers
  B. The search peers pull the data from the forwarders.
  C. Peers run searches in parallel and return their portion of results.
  D. The search head consolidates the individual results and prepares reports
  A. The search head dispatches searches to the peers
  C. Peers run searches in parallel and return their portion of results.
  D. The search head consolidates the individual results and prepares reports

  ---

  Explanation/Reference:

  Users log on to the search head and run reports: The search head dispatches searches to the peers Peers run searches in parallel and return their portion of results The search head consolidates the individual results and prepares reports

• Question 168:

  Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.

  Which configuration file and stanza pair will mask possible SSNs in the log events?

  A. props.conf [mask-SSN] REX = (?ms)^(.)\\d{3}-?\d{2}-?(\d{4}.*)$" FORMAT = $1###-##-$2 KEY = _raw
  B. props.conf [mask-SSN] REGEX = (?ms)^(.)\\d{3}-?\d{2}-?(\d{4}.*)$" FORMAT = $1###-##-$2 DEST_KEY = _raw
  C. transforms.conf [mask-SSN] REX = (?ms)^(.)\\d{3}-?\d{2}-?(\d{4}.*)$" FORMAT = $1###-##-$2 DEST_KEY = _raw
  D. transforms.conf [mask-SSN] REGEX = (?ms)^(.)\\d{3}-?\d{2}-?(\d{4}.*)$" FORMAT = $1###-##-$2 DEST_KEY = _raw
  D. transforms.conf [mask-SSN] REGEX = (?ms)^(.)\\d{3}-?\d{2}-?(\d{4}.*)$" FORMAT = $1###-##-$2 DEST_KEY = _raw

  ---

  Explanation/Reference:

  because transforms.conf is the right configuration file to state the regex expression.https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Transformsconf

  Reference: https://community.splunk.com/t5/Archive/How-to-mask-SSN-into-our-logs- going-into-Splunk/tdp/433035

• Question 169:

  What options are available when creating custom roles? (select all that apply)

  A. Restrict search terms
  B. Whitelist search terms
  C. Limit the number of concurrent search jobs
  D. Allow or restrict indexes that can be searched.
  A. Restrict search terms
  C. Limit the number of concurrent search jobs
  D. Allow or restrict indexes that can be searched.

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/SplunkCloud/8.2.2106/Admin/ConcurrentLimits "Set limits for concurrent scheduled searches. You must have the edit_search_concurrency_all and edit_search_concurrency_scheduled capabilities to configure these settings."

• Question 170:

  What is a role in Splunk? (select all that apply)

  A. A classification that determines what capabilities a user has.
  B. A classification that determines if a Splunk server can remotely control another Splunk server.
  C. A classification that determines what functions a Splunk server controls.
  D. A classification that determines what indexes a user can search.
  A. A classification that determines what capabilities a user has.
  D. A classification that determines what indexes a user can search.

  ---

  Explanation/Reference:

  A role in Splunk is a classification that determines what capabilities and indexes a user has.A capability is a permission to perform a specific action or access a specific feature on the Splunk platform1.An index is a collection of data that Splunk software processes and stores2. By assigning roles to users, you can control what they can do and what data they can access on the Splunk platform. Therefore, the correct answers are A and D. A role in Splunk determines what capabilities and indexes a user has. Option B is incorrect because Splunk servers do not use roles to remotely control each other.Option C is incorrect because Splunk servers use instances and components to determine what functions they control3. References:1:Define roles on the Splunk platform with capabilities - Splunk Documentation2:About indexes and indexers - Splunk Documentation3:Splunk Enterprise components - Splunk Documentation