Skip to main content

SPLK-2001 Real Exam Questions

Splunk Certified Developer

70 questions available · Page 1 of 7

Updated Exam DumpsVerified AnswersPass Guarantee

Get Complete Exam Dumps
Question 1 Multiple choice

Which items below are configured in inputs.conf? (Select all that apply.)

  1. A

    A modular input written in Python.

  2. B

    A file input monitoring a JSON file.

  3. C

    A custom search command written in Python.

  4. D

    An HTTP Event Collector as receiver of data from an app.

Show answer and explanation

Correct answers: A, D

Question 2 Single choice

Consider the following Python code snippet used in a Splunk add-on:

if not os.path.exists(full_path): self.doAction(full_path, header) else: f = open(full_path) oldORnew =
f.readline().split(",") f.close() An attacker could create a denial of service by causing an error in either the open() or readline() commands.

What type of vulnerability is this?

  1. A

    CWE-693: Protection Mechanism Failure

  2. B

    CWE-562: Return of Stack Variable Address

  3. C

    CWE-404: Improper Resource Shutdown or Release

  4. D

    CWE-636: Not Failing Securely (`Failing Open')

Show answer and explanation

Correct answer: C

Explanation

References:
https://dev.splunk.com/enterprise/docs/developapps/testvalidate/securitybestpractices/

Question 3 Multiple choice

Which of the following statements describe an HEC token? (Select all that apply.)

  1. A

    Maps to a Splunk user.

  2. B

    Can be used to download data.

  3. C

    Is a GUID (globally unique identifier).

  4. D

    Can be created in Splunk Web or using REST endpoints.

Show answer and explanation

Correct answers: C, D

Question 4 Multiple choice

For a KV store, a lookup stanza in the transforms.conf file must contain which of the following? (Select all that apply.)

  1. A

    collection

  2. B

    fields_list

  3. C

    external_type

  4. D

    internal_type

Show answer and explanation

Correct answers: A, B

Explanation

References:
https://docs.splunk.com/Documentation/Splunk/8.1.2/Knowledge/ConfigureKVstorelookups

Question 5 Single choice

Given a dashboard with a Simple XML extension in myApp, what is the XML reference for the file myJS.js located in myOtherApp in the location shown below?

$SPLUNK_HOME/etc/apps/myOtherApp/appserver/static/javascript/

  1. A
    <dashboard script="myJs.js">
  2. B
    <dashboard script="myOtherApp/myJS.js">
  3. C
    <dashboard script="myOtherApp:javascript/myJS.js">
  4. D
    <dashboard script="myOtherApp:appserver/static/javascript/myJS.js">
Show answer and explanation

Correct answer: A

Explanation

References:
https://dev.splunk.com/enterprise/docs/developapps/visualizedata/usewebframework/modifydashboards/

Question 6 Single choice

In a DELETE request, what would omitting the value of_key from the REST endpoint do?

  1. A

    Clean the KV store, deleting all content.

  2. B

    Produce the syntax error "Key value missing".

  3. C

    Cause all records in a collection to be deleted.

  4. D

    Mean that the_key value must be passed as an argument.

Show answer and explanation

Correct answer: C

Question 7 Single choice

Assuming permissions are set appropriately, which REST endpoint path can be used by someone with a power user role to access information about mySearch, a saved search owned by someone with a user role?

  1. A

    /servicesNS/-/data/saved/searches/mySearch

  2. B

    /servicesNS/object/saved/searches/mySearch

  3. C

    /servicesNS/search/saved/searches/mySearch

  4. D

    /servicesNS/-/search/saved/searches/mySearch

Show answer and explanation

Correct answer: D

Explanation

References:
https://docs.splunk.com/Documentation/Splunk/8.1.2/RESTUM/RESTusing

Question 8 Single choice

A fellow Splunk administrator is reviewing an app that has been downloaded from splunkbase and deployed in an organization. The admin has e-mailed the following configuration snippet with a brief note that says "fix the permissions".
In what configuration file should the snippet be placed?

[]
access = read : [ * ], write : [ admin ]
export - system

(Assume that $APP_HOME refers to the path that the app is installed, e.g. $SPLUNK_HOME/etc/apps/
<app name>)

  1. A

    $APP_HOME/default/app.conf

  2. B

    $APP_HOME/local/default.meta

  3. C

    $APP_HOME/metadata/local.meta

  4. D

    $SPLUNK_HOME/etc/system/local/server.conf

Show answer and explanation

Correct answer: D

Question 9 Single choice

Which of the following is an example of a valid syntax for specifying an absolute time range modifier in a search?

  1. A

    earliest=01/01/2019:00:00:00

  2. B

    earliest=01/01/2019T00:00:00

  3. C

    earliest=2019-01-01 00:00:00

  4. D

    earliest=2019-01-01T00:00:00

Show answer and explanation

Correct answer: A

Explanation

References:
https://docs.splunk.com/Documentation/Splunk/8.1.2/Search/Specifytimemodifiersinyoursearch

Question 10 Multiple choice

When the search/jobs REST endpoint is called to execute a search, what can be done to reduce the results size in the results? (Select all that apply.)

  1. A

    Use a generating search.

  2. B

    Remove unneeded fields.

  3. C

    Truncate the data, using selective functions.

  4. D

    Summarize data, using analytic commands.

Show answer and explanation

Correct answers: A, B