Splunk SPLK-1005 Online Practice Questions and Exam Preparation

Splunk SPLK-1005 Online Questions & Answers

• Question 1:

  What is the name of the Splunk Enterprise feature that provides a security data and event management (SIEM) solution that uses machine data to detect and respond to threats?

  A. Splunk Enterprise Security
  B. Splunk Enterprise Intelligence
  C. Splunk Enterprise Analytics
  D. Splunk Enterprise Monitoring
  A. Splunk Enterprise Security

• Question 2:

  What is the name of the input processor that allows you to monitor files that Windows rotates automatically on machines that run Windows Vista or Windows Server 2008 and higher?

  A. monitor
  B. MonitorNoHandle
  C. upload
  D. UploadNoHandle
  B. MonitorNoHandle

• Question 3:

  What is the name of the configuration file where you can define data transformations using regular expressions and other attributes?

  A. limits.conf
  B. props.conf
  C. inputs.conf
  D. transforms.conf
  D. transforms.conf

• Question 4:

  What is the name of the attribute that specifies the sed script for data transformation in the props.conf file?

  A. SEDCMD
  B. FORMAT
  C. DEST_KEY
  D. TRANSFORMS
  A. SEDCMD

• Question 5:

  Which attribute in outputs.conf can be used to specify the load balancing method for a group of forwarders?

  A. autoLB
  B. autoLBFrequency
  C. lb_method
  D. lb_poll
  C. lb_method

• Question 6:

  Which type of forwarder is a legacy option that is not recommended for new deployments?

  A. Universal forwarder
  B. Heavy forwarder
  C. Light forwarder
  D. Deployment client
  C. Light forwarder

• Question 7:

  Which command can be used to add a data input using the CLI?

  A. splunk add input
  B. splunk add monitor
  C. splunk add data
  D. splunk add source
  B. splunk add monitor

• Question 8:

  Which configuration file needs to be edited to configure the universal forwarder to act as a deployment client?

  A. deploymentclient.conf
  B. server.conf
  C. outputs.conf
  D. inputs.conf
  A. deploymentclient.conf

• Question 9:

  Which feature allows a heavy forwarder to route data to different indexers based on criteria such as source, sourcetype, or host?

  A. Data cloning
  B. Data filtering
  C. Data sampling
  D. Data masking
  A. Data cloning

• Question 10:

  Which configuration file parameter can be used to modify line termination settings interactively, using the Set Source Type page in Splunk Web?

  A. LINE_BREAKER
  B. SHOULD_LINEMERGE
  C. BREAK_ONLY_BEFORE
  D. TRUNCATE
  B. SHOULD_LINEMERGE