Splunk SPLK-3003 Online Practice Questions and Exam Preparation

Splunk SPLK-3003 Online Questions & Answers

• Question 11:

  Where are Splunk Data Model Acceleration (DMA) summaries stored?

  A. In tstatsHomePath
  B. In the .tsidx files.
  C. In summaryHomePath
  D. In journal.gz
  A. In tstatsHomePath

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Knowledge/Acceleratedatamodels#:~:text=Splunk%20software%20creates%20ad%20hoc,your%20indexes%20alongside%20index%20buckets

• Question 12:

  Which event processing pipeline contains the regex replacement processor that would be called upon to run event masking routines on events as they are ingested?

  A. Merging pipeline
  B. Indexing pipeline
  C. Typing pipeline
  D. Parsing pipeline
  A. Merging pipeline

• Question 13:

  A customer has a search cluster (SHC) of six members split evenly between two data centers (DC). The customer is concerned with network connectivity between the two DCs due to frequent outages. Which of the following is true as it relates to SHC resiliency when a network outage occurs between the two DCs?

  A. The SHC will function as expected as the SHC deployer will become the new captain until the network communication is restored.
  B. The SHC will stop all scheduled search activity within the SHC.
  C. The SHC will function as expected as the minimum required number of nodes for a SHC is 3.
  D. The SHC will function as expected as the SHC captain will fall back to previous active captain in the remaining site.
  D. The SHC will function as expected as the SHC captain will fall back to previous active captain in the remaining site.

• Question 14:

  A customer wants to migrate from using Splunk local accounts to use Active Directory with LDAP for their Splunk user accounts instead. Which configuration files must be modified to connect to an Active Directory LDAP provider?

  A. authentication.conf, authorize.conf, ldap.conf
  B. authentication.conf, ldap.conf
  C. authentication.conf
  D. authorize.conf, authentication.conf
  C. authentication.conf

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Security/ConfigureLDAPwithconfigurationfiles

• Question 15:

  In a large cloud customer environment with many (>100) dynamically created endpoint systems, each with a UF already deployed, what is the best approach for associating these systems with an appropriate serverclass on the deployment server?

  A. Work with the cloud orchestration team to create a common host-naming convention for these systems so a simple pattern can be used in the serverclass.conf whitelist attribute.
  B. Create a CSV lookup file for each severclass, manually keep track of the endpoints within this CSV file, and leverage the whitelist.from_pathname attribute in serverclass.conf.
  C. Work with the cloud orchestration team to dynamically insert an appropriate clientName setting into each endpoint's local/deploymentclient.conf which can be matched by whitelist in serverclass.conf.
  D. Using an installation bootstrap script run a CLI command to assign a clientName setting and permit serverclass.conf whitelist simplification.
  C. Work with the cloud orchestration team to dynamically insert an appropriate clientName setting into each endpoint's local/deploymentclient.conf which can be matched by whitelist in serverclass.conf.

• Question 16:

  A customer with a large distributed environment has blacklisted a large lookup from the search bundle to decrease the bundle size using distsearch.conf. After this change, when running searches utilizing the lookup that was blacklisted they see error messages in the Splunk Search UI stating the lookup file does not exist.

  What can the customer do to resolve the issue?

  A. The search needs to be modified to ensure the lookup command specifies parameter local=true.
  B. The blacklisted lookup definition stanza needs to be modified to specify setting allow_caching=true.
  C. The search needs to be modified to ensure the lookup command specified parameter blacklist=false.
  D. The lookup cannot be blacklisted; the change must be reverted.
  A. The search needs to be modified to ensure the lookup command specifies parameter local=true.

• Question 17:

  Which of the following server.conf stanzas indicates the Indexer Discovery feature has not been fully configured (restart pending) on the Master Node?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  C. Option C

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/indexerdiscovery

• Question 18:

  The Splunk Validated Architectures (SVAs) document provides a series of approved Splunk topologies. Which statement accurately describes how it should be used by a customer?

  A. Customer should look at the category tables, pick the highest number that their budget permits, then select this design topology as the chosen design.
  B. Customers should identify their requirements, provisionally choose an approved design that meets them, then consider design principles and best practices to come to an informed design decision.
  C. Using the guided requirements gathering in the SVAs document, choose a topology that suits requirements, and be sure not to deviate from the specified design.
  D. Choose an SVA topology code that includes Search Head and Indexer Clustering because it offers the highest level of resilience.
  B. Customers should identify their requirements, provisionally choose an approved design that meets them, then consider design principles and best practices to come to an informed design decision.

  ---

  Reference: https://www.splunk.com/en_us/blog/tips-and-tricks/splunk-validated-architectures.html

• Question 19:

  Where does the bloomfilter reside?

  A. $SPLUNK_HOME/var/lib/splunk/indexfoo/db/db_1553504858_1553504507_8
  B. $SPLUNK_HOME/var/lib/splunk/indexfoo/db/db_1553504858_1553504507_8/*.tsidx
  C. $SPLUNK_HOME/var/lib/splunk/fishbucket
  D. $SPLUNK_HOME/var/lib/splunk/indexfoo/db/db_1553504858_1553504507_8/rawdata
  C. $SPLUNK_HOME/var/lib/splunk/fishbucket

• Question 20:

  When can the Search Job Inspector be used to debug searches?

  A. If the search has not expired.
  B. If the search is currently running.
  C. If the search has been queued.
  D. If the search has expired.
  A. If the search has not expired.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/8.1.0/Search/ViewsearchjobpropertieswiththeJobInspector