SPLK-1003 Exam Training Practice Tests (Splunk Enterprise Certified Admin)]

Question 1

Which Splunk component does a search head primarily communicate with?

A. Indexer B. Deployment server C. Forwarder D. Cluster master

Correct Answer: A

Question 2

To set up a Network input in Splunk, what needs to be specified'?

A. Network protocol and MAC address. B. Username and password C. Network protocol and port number. D. File path.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 3

Which network input option provides durable file-system buffering of data to mitigate data loss due to network outages and splunkd restarts?

A. durableQueueSize B. queueSize C. diskQueueSize D. persistentOueueSize

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

Which forwarder is recommended by Splunk to use in a production environment?

A. SSL forwarder B. Universal forwarder C. Lightweight forwarder D. Heavy forwarder

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 5

In which of the following scenarios would a monitored log file be re-ingested by Splunk?

A. The fish bucket checkpoint is cleared. B. The Splunk instance is restarted. C. The log file is renamed. D. A second file monitor is set up to ingest the log.

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 6

How would you configure your distsearch.conf to allow you to run the search below?
sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON

A. [distributedSearch]
servers = nyc1, nyc2, houston1, houston2
[distributedSearch: NYC]
default = false
servers = nyc1, nyc2
[distributedSearch:HOUSTON]
default = false
servers = houston1, houston2 B. [distributedSearch:NYC]
default = false
servers = nyc1:8089, nyc2:8089
[distributedSearch:HOUSTON]
default = false
servers = houston1:8089, houston2:8089 C. [distributedSearch]
servers = nyc1:8089, nyc2:8089, houston1:8089, houston2:8089
[distributedSearch:NYC]
default = false
servers = nyc1:8089, nyc2:8089
[distributedSearch:HOUSTON]
default = false
servers = houston1:8089, houston2:8089 D. [distributedSearch]
servers = nyc1:8089; nyc2:80894; houston1:8089; houston2:8089
[distributedSearch:NYC]
default = false
servers = nyc1:8089; nyc2:8089
[distributedSearch:HOUSTON]
default = false
servers = houston1:80899957; houston2:80899049

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

A. transforms.conf
[mask-SSN]
REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw B. transforms.conf
[mask-SSN]
REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw C. props.conf
[mask-SSN]
REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1<SSN>###-##-$2
DEST_KEY = _raw D. props.conf
[mask-SSN]
REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
FORMAT = $1<SSN>###-##-$2
KEY = _raw

Correct Answer: A

Question 8

The LINE_BREAKER attribute is configured in which configuration file?

A. indexes.conf B. inpucs.conf C. transforms.conf D. props.conf

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 9

What is the order in which apps are searched for tags.confat search time?

A. Alpha-numeric B. Reverse-lexicographical C. Alphabetical D. Lexicographical

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 10

Which of the following configuration files are used with a universal forwarder? (Choose all that apply.)

A. inputs.conf B. forwarder.conf C. outputs.conf D. monitor.conf

Correct Answer: A,C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 11

After an Enterprise Trial license expires, it will automatically convert to a Free license. How many days is an Enterprise Trial license valid before this conversion occurs?

A. 7 days B. 60 days C. 90 days D. 14 days

Correct Answer: B

Splunk Enterprise Certified Admin - SPLK-1003 Exam Practice Test