Splunk Enterprise Certified Admin - SPLK-1003 Exam Practice Test

Question 1

What happens when there are conflicting settings within two or more configuration files?

A. The setting is ignored until conflict is resolved.

B. The setting with the lowest precedence is used.

C. The setting for both values will be used together.

D. The setting with the highest precedence is used.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

Which file will be matched for the following monitor stanza in inputs. conf?

A. /var/log/host_460352847/bar/file/foo.txt

B. [monitor: ///var/log/*/bar/*. txt]

C. /var/log/host_460352847/bar/foo.txt

D. /var/log/host_460352847/temp/bar/file/csv/foo.txt

E. /var/ log/ host_460352847/temp/bar/file/foo.txt

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

Metadata settings are assigned when Splunk indexes event data. Which of the following is not a default metadata value?

A. source

B. index

C. permissions
D
host

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

Which option on the Add Data menu is most useful for testing data ingestion without creating inputs.conf?

A. Upload option

B. Monitor option

C. Download option

D. Forward option

Correct Answer: A

Question 5

A log file contains 193 days worth of timestamped events. Which monitor stanza would be used to collect data 45 days old and newer from that log file?

A. ignoreOlderThan = 45d

B. ignore = 45d

C. followTail = -45d

D. includeNewerThan = -35d

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

Which of the following is true when authenticating users to Splunk using LDAP?

A. LDAP will take precedence over local users with the same username as defined in etc/passwd.

B. Splunk only supports encrypted LDAP connections.

C. LDAP group names must match the Splunk role name defined in authorize.conf.

D. Splunk will search each LDAP strategy in the order in which they are listed in authentication.conf.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

Load balancing on a Universal Forwarder is not scaling correctly. The forwarder's outputs. and the tcpout stanza are setup correctly. What else could be the cause of this scaling issue? (select all that apply)

A. The receiving port is not properly setup to listen on the right port.

B. The inputs . conf'S _SYSZOG_ROVTING is not setup to use the right group names.

C. The DNS record used is not setup with a valid list of IP addresses.

D. The indexAndForward value is not set properly.

Correct Answer: A,C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 8

Which of the methods listed below supports multi-factor authentication?

A. Single Sign-On (SSO)

B. Lightweight Directory Access Protocol (LDAP)

C. OpenID

D. Security Assertion Markup Language (SAML)

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 9

What is an example of a proper configuration for CHARSET within props.conf?

A. [sourcetype: : son]
CHARSET = BIG5

B. [source: : /var/log/ splunk]
CHARSET = BIG5

C. [host: : server. splunk. com]
CHARSET = BIG5

D. [index: :main]
CHARSET = BIG5

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 10

Which stanza value in props.confdefines index-time data masking?

A. TRACT

B. TRANSFORMS

C. REPORT

D. TRUNCATE

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Splunk Enterprise Certified Admin - SPLK-1003 Exam Practice Test

Latest Update

Useful Links

Contact Us