Splunk SPLK-1003 Online Practice Questions and Exam Preparation

Splunk SPLK-1003 Online Questions & Answers

• Question 51:

  The following stanzas in inputs. conf are currently being used by a deployment client: [udp: //145.175.118.177:1001 Connection_host = dns sourcetype = syslog Which of the following statements is true of data that is received via this input?

  A. If Splunk is restarted, data will be queued and then sent when Splunk has restarted.
  B. Local firewall ports do not need to be opened on the deployment client since the port is defined in inputs.conf.
  C. The host value associated with data received will be the IP address that sent the data.
  D. If Splunk is restarted, data may be lost.
  D. If Splunk is restarted, data may be lost.

  ---

  Explanation/Reference:

  This is because the input type is UDP, which is an unreliable protocol that does not guarantee delivery, order, or integrity of the data packets. UDP does not have any mechanism to resend or acknowledge the data packets, so if Splunk is restarted, any data that was in transit or in the buffer may be dropped and not indexed.

• Question 52:

  When Splunk is integrated with LDAP, which attribute can be changed in the Splunk UI for an LDAP user?

  A. Default app
  B. LDAP group
  C. Password
  D. Username
  A. Default app

  ---

  Explanation/Reference:

  When Splunk is integrated with LDAP, most of the user attributes are managed by the LDAP server and cannot be changed in the Splunk UI. However, one exception is the default app attribute, which specifies which app a user sees when they log in to Splunk. This attribute can be changed in the Splunk UI by editing the user settings. Therefore, option A is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [Configure Splunk to use LDAP and map groups - Splunk Documentation]

• Question 53:

  When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

  A. App Class
  B. Client Class
  C. Server Class
  D. Forwarder Class
  C. Server Class

  ---

  Explanation/Reference:

  https://docs.splunk.com/Splexicon:Serverclass

• Question 54:

  Which is a valid stanza for a network input?

  A. [udp://172.16.10.1:9997] connection = dns sourcetype = dns
  B. [any://172.16.10.1:10001] connection_host = ip sourcetype = web
  C. [tcp://172.16.10.1:9997] connection_host = web sourcetype = web
  D. [tcp://172.16.10.1:10001] connection_host = dns sourcetype = dns
  D. [tcp://172.16.10.1:10001] connection_host = dns sourcetype = dns

• Question 55:

  In a customer managed Splunk Enterprise environment, what is the endpoint URI used to collect data?

  A. services/ collector
  B. services/ inputs ? raw
  C. services/ data/ collector
  D. data/ collector
  C. services/ data/ collector

  ---

  Explanation/Reference:

  The answer to your question is C. services/data/collector. This is the endpoint URI used to collect data in a customer managed Splunk Enterprise environment.According to the Splunk documentation1, "The HTTP Event Collector REST API

  endpoint is /services/data/collector.You can use this endpoint to send events to HTTP Event Collector on a Splunk Enterprise or Splunk Cloud Platform deployment." You can also use this endpoint to send events to a specific token or index1.

  For example, you can use thefollowing curl command to send an event with the token 578254cc-05f5-46b5-957b- 910d1400341a and the index main:

  curl -k https://localhost:8088/services/data/collector -H'Authorization: Splunk 578254cc- 05f5-46b5-957b-910d1400341a'-d'{"index":"main","event":"Hello, world!"}'

• Question 56:

  What are the values forhostandindexfor[stanza1]used by Splunk during index time, given the following configuration files?

  

  A. host=server1 index=unixinfo
  B. host=server1 index=searchinfo
  C. host=searchsvr1 index=searchinfo
  D. host=unixsvr1 index=unixinfo
  A. host=server1 index=unixinfo

  ---

  Explanation/Reference:

  - etc/system/local/ has better precedence at index time - for identical settings in the same file, the last one overwrite others, see :https://community.splunk.com/t5/Getting-Data-In/What-is-the-precedence-for-identical- stanzas-within-a-single/ m-p/283566

• Question 57:

  What happens when the same username exists in Splunk as well as through LDAP?

  A. Splunk user is automatically deleted from authentication.conf.
  B. LDAP settings take precedence.
  C. Splunk settings take precedence.
  D. LDAP user is automatically deleted from authentication.conf
  C. Splunk settings take precedence.

  ---

  Explanation/Reference:

  Reference:https://docs.splunk.com/Documentation/SplunkCloud/8.2.2105/Security/SetupuserauthenticationwithLDAP

  Splunk platform attempts native authentication first. If authentication fails outside of a local account that doesn't exist, there is no attempt to use LDAP to log in. This is adapted from precedence of Splunk authentication schema.

• Question 58:

  A log file contains 193 days worth of timestamped events. Which monitor stanza would be used to collect data 45 days old and newer from that log file?

  A. followTail = -45d
  B. ignore = 45d
  C. includeNewerThan = -35d
  D. ignoreOlderThan = 45d
  D. ignoreOlderThan = 45d

  ---

  Explanation/Reference:

  Reference:https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Configuretimestampr ecognition

• Question 59:

  Which data pipeline phase is the last opportunity for defining event boundaries?

  A. Input phase
  B. Indexing phase
  C. Parsing phase
  D. Search phase
  C. Parsing phase

  ---

  Explanation/Reference:

  Referencehttps://docs.splunk.com/Documentation/Splunk/8.2.3/Admin/Configurationparam etersandthedatapipeline

  The parsing phase is the process of extracting fields and values from raw data. The parsing phase respects LINE_BREAKER, SHOULD_LINEMERGE, BREAK_ONLY_BEFORE_DATE, and all other line merging settings in props.conf. These settings determine how Splunk breaks the data into events based on certain criteria, such as timestamps or regular expressions. The event boundaries are defined by the props.conf file, which can be modified by the administrator. Therefore, the parsing phase is the last opportunity for defining event boundaries.

• Question 60:

  What is the default character encoding used by Splunk during the input phase?

  A. UTF-8
  B. UTF-16
  C. EBCDIC
  D. ISO 8859
  A. UTF-8

  ---

  Explanation/Reference:

  https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Configurecharactersetencoding

  "Configure character set encoding. Splunk software attempts to apply UTF-8 encoding to your scources by default. If a source foesn't use UTF-8 encoding or is a non-ASCII file, Splunk software tries to convert data from the source to UTF-8 encoding unless you specify a character set to use by setting the CHARSET key in the props.conf file."