SPLUNK-SPLK-1003 – Practice Exam Questions (61

Which of the following statements describe deployment management?

#61

During search time, which directory of configuration files has the highest precedence?

#62

Within props.conf, which stanzas are valid for data modification?

#63

What is the correct order of steps in Duo Multifactor Authentication?

#64

Where can scripts for scripted inputs reside on the host file system?

#65

In a distributed environment, which Splunk component is used to distribute apps and configurations to the other Splunk instances?

#66

How is a remote monitor input distributed to forwarders?

#67

How is data handled by Splunk during the input phase of the data ingestion process?

#68

Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

#69

Which option on the Add Data menu is most useful for testing data ingestion without creating inputs.conf?

#70

Which of the following primary authentication methods is not supported with Splunk handling its paired multi-factor authentication method?

#71

The universal forwarder has which capabilities when sending data?

#72

Which optional configuration setting in inputs.conf allows you to selectively forward the data to specific indexer(s)?

#73

To set up a network input in Splunk, what needs to be specified?

#74

Which Splunk forwarder type allows parsing of data before forwarding to an indexer?

#75

Which of the following is accurate regarding the input phase?

#76

When indexing a data source, which fields are considered metadata?

#77

What is the default value of LINE_BREAKER?

#78

Which of the following monitor inputs stanza headers would match all of the following files? /var/log/www1/secure.log /var/log/www/secure.l /var/log/www/logs/secure.logs /var/log/www2/secure.log

#79

What are the values for host and index for [stanza1] used by Splunk during index time, given the following configuration files?

#80

Windows can prevent a Splunk forwarder from reading open files. If files need to be read while they are being written to, what type of input stanza needs to be created?

#81

What is required when adding a native user to Splunk?

#82

When deploying apps on Universal Forwarders using the deployment server, what is the correct component and location of the app before it is deployed?

#83

Which pathway represents where a network input in Splunk might be found?

#84

What are the minimum required settings when creating a network input in Splunk?

#85

Local user accounts created in Splunk store passwords in which file?

#86

For single line event sourcetypes, it is most efficient to set SHOULD_LINEMERGE to what value?

#87

Which Splunk component does a search head primarily communicate with?

#88

In which Splunk configuration is the SEDCMD used?

#89

Which layers are involved in Splunk configuration file layering?

#90