Splunk SPLK-1003 Online Practice Questions and Exam Preparation

Splunk SPLK-1003 Online Questions & Answers

• Question 41:

  Which of the following is a valid distributed search group?

  A. [distributedSearch:Paris] default = false servers = server1, server2
  B. [searchGroup:Paris] default = false servers = server1:8089, server2:8089
  C. [searchGroup:Paris] default = false servers = server1:9997, server2:9997
  D. [distributedSearch:Paris] default = false servers = server1:8089; server2:8089
  D. [distributedSearch:Paris] default = false servers = server1:8089; server2:8089

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/9.0.0/DistSearch/Distributedsearchgroups

• Question 42:

  When running a real-time search, search results are pulled from which Splunk component?

  A. Heavy forwarders and search peers
  B. Heavy forwarders
  C. Search heads
  D. Search peers
  D. Search peers

  ---

  Explanation/Reference:

  Using the Splunk reference URLhttps://docs.splunk.com/Splexicon:Searchpeer

  "search peer is a splunk platform instance that responds to search requests from a search head. The term "search peer" is usally synonymous with the indexer role in a distributed search topology. However, other instance types also have access to indexed data, particularly internal diagnostic data, and thus function as search peers when they respond to search requests for that data."

• Question 43:

  Which of the following is the use case for the deployment server feature of Splunk?

  A. Managing distributed workloads in a Splunk environment.
  B. Automating upgrades of Splunk forwarder installations on endpoints.
  C. Orchestrating the operations and scale of a containerized Splunk deployment.
  D. Updating configuration and distributing apps to processing components, primarily forwarders.
  D. Updating configuration and distributing apps to processing components, primarily forwarders.

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/8.2.2/Updating/Aboutdeploymentserver "The deployment server is the tool for distributing configurations, apps, and content updates to groups of Splunk Enterprise instances."

• Question 44:

  What is the correct curl to send multiple events through HTTP Event Collector?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  B. Option B

  ---

  Explanation/Reference:

  curl "https://mysplunkserver.example.com:8088/services/collector" \ -H "Authorization: Splunk DF4S7ZE4-3GS1-8SFS-E777-0284GG91PF67" \ -d `{"event": "Hello World"}, {"event": "Hola Mundo"}, {"event": "Hallo Welt"}'. This is the correct curl command to send multiple events through HTTP Event Collector (HEC), which is a token-based API that allows you to send data to Splunk Enterprise from any application that can make an HTTP request. The command has the following components: The URL of the HEC endpoint, which consists of the protocol (https), the hostname or IP address of the Splunk server (mysplunkserver.example.com), the port number (8088), and the service name (services/collector). The header that contains the authorization token, which is a unique identifier that grants access to the HEC endpoint. The token is prefixed with Splunk and enclosed in quotation marks. The token value (DF4S7ZE4-3GS1-8SFS-E777- 0284GG91PF67) is an example and should be replaced with your own token value. The data payload that contains the events to be sent, which are JSON objects enclosed in curly braces and separated by commas. Each event object has a mandatory field called event, which contains the raw data to be indexed. The event value can be a string, a number, a boolean, an array, or another JSON object. In this case, the event values are strings that say hello in different languages.

• Question 45:

  A security team needs to ingest a static file for a specific incident. The log file has not been collected previously and future updates to the file must not be indexed.

  Which command would meet these needs?

  A. splunk add one shot / opt/ incident [data .log --index incident
  B. splunk edit monitor /opt/incident/data.* --index incident
  C. splunk add monitor /opt/incident/data.log --index incident
  D. splunk edit oneshot [opt/ incident/data.* --index incident
  A. splunk add one shot / opt/ incident [data .log --index incident

  ---

  Explanation/Reference:

  The correct answer is A. splunk add one shot / opt/ incident [data . log --index incident According to the Splunk documentation1, the splunk add one shot command adds a single file or directory to the Splunk index and then stops monitoring it.

  This is useful for ingesting static files that do not change or update. The command takes the following syntax:

  splunk add one shot -index

  The file parameter specifies the path to the file or directory to be indexed. The index parameter specifies the name of the index where the data will be stored. If the index does not exist, Splunk will create it automatically. Option B is incorrect because the splunk edit monitor command modifies an existing monitor input, which is used for ingesting files or directories that change or update over time. This command does not create a new monitor input, nor does it stop monitoring after indexing. Option C is incorrect because the splunk add monitor command creates a new monitor input, which is also used for ingesting files or directories that change or update over time. This command does not stop monitoring after indexing. Option D is incorrect because the splunk edit oneshot command does not exist. There is no such command in the Splunk CLI. References:1:Monitor files and directories with inputs.conf - Splunk Documentation

• Question 46:

  In this example, ifuseACKis set to true and themaxQueueSizeis set to 7MB, what is the size of the wait queue on this universal forwarder?

  A. 21MB
  B. 28MB
  C. 14MB
  D. 7MB
  A. 21MB

• Question 47:

  After automatic load balancing is enabled on a forwarder, the time interval for switching indexers can be updated by using which of the following attributes?

  A. channelTTL
  B. connectionTimeout
  C. autoLBFrequency
  D. secsInFailurelnterval
  C. autoLBFrequency

  ---

  Explanation/Reference:

  Reference:https://docs.splunk.com/Documentation/Forwarder/8.2.1/Forwarder/Configurelo adbalancing

• Question 48:

  What is the correct order of steps in Duo Multifactor Authentication?

  A. 1 Request Login 2. Connect to SAML server 3 Duo MFA 4 Create User session 5 Authentication Granted 6. Log into Splunk
  B. 1. Request Login 2 Duo MFA 3. Authentication Granted 4 Connect to SAML server 5. Log into Splunk 6. Create User session
  C. 1 Request Login 2 Check authentication / group mapping 3 Authentication Granted 4. Duo MFA 5. Create User session 6. Log into Splunk
  D. 1 Request Login 2 Duo MFA 3. Check authentication / group mapping 4 Create User session 5. Authentication Granted 6 Log into Splunk
  C. 1 Request Login 2 Check authentication / group mapping 3 Authentication Granted 4. Duo MFA 5. Create User session 6. Log into Splunk

  ---

  Explanation/Reference:

  Using the provided DUO/Splunk reference URLhttps://duo.com/docs/splunk

  Scroll down to the Network Diagram section and note the following 6 similar steps 1 - SPlunk connection initiated 2 - Primary authentication 3 - Splunk connection established to Duo Security over TCP port 443 4 - Secondary authentication via Duo Security's service 5 - Splunk receives authentication response 6 - Splunk session logged in.

• Question 49:

  What type of Splunk license is pre-selected in a brand new Splunk installation?

  A. Free license
  B. Forwarder license
  C. Enterprise trial license
  D. Enterprise license
  C. Enterprise trial license

  ---

  Explanation/Reference:

  A Splunk Enterprise trial license gives you access to all the features of Splunk Enterprise for a limited period of time, usually 60 days1. After the trial period expires, you can either purchase a Splunk Enterprise license or switch to a Free license. A Splunk Enterprise Free license allows you to index up to 500 MB of data per day, but some features are disabled, such as authentication, distributed search, and alerting. You can switch to a Free license at any time during the trial period or after the trial period expires. A Splunk Enterprise Forwarder license is used with forwarders, which are Splunk instances that forward data to other Splunk instances. A Forwarder license does not allow indexing or searching of data. You can install a Forwarder license on any Splunk instance that you want to use as a forwarder. A Splunk Enterprise commercial end-user license is a license that you purchase from Splunk based on either data volume or infrastructure. This license gives you access to all the features of Splunk Enterprise within a defined limit of indexed data per day (volume-based license) or vCPU count (infrastructure license). You can purchase and install this license after the trial period expires or at any time during the trial period1.

• Question 50:

  Which of the following authentication types requires scripting in Splunk?

  A. ADFS
  B. LDAP
  C. SAML
  D. RADIUS
  A. ADFS
  D. RADIUS