SPLK-1003 Practice Test 10 — 10 Questions

Question 1

You need to restrict a specific user role from searching a particular index. Where is this configuration defined?

Accepted Answer

authorize.conf. Role-based access control (RBAC) allows you to restrict indexed data access via the 'srchIndexesAllowed' setting in authorize.conf.

Answer

user-prefs.conf

Answer

indexes.conf

Answer

authentication.conf

Question 2

What is the primary function of the 'Indexer Cluster' feature?

Accepted Answer

To provide data replication and high availability.. Indexer Clustering provides data high availability and replication across multiple indexers.

Answer

To increase the web interface speed.

Answer

To speed up search queries across multiple head nodes.

Answer

To manage user permissions for index access.

Question 3

Which file is responsible for defining how data is rotated in an index?

Accepted Answer

indexes.conf. indexes.conf contains settings like maxDataSize and maxHotSpanSecs which define data rotation.

Answer

inputs.conf

Answer

props.conf

Answer

server.conf

Question 4

Which TWO directories are part of the standard Splunk configuration file precedence hierarchy?

Accepted Answer

$SPLUNK_HOME/etc/apps/app_name/default. System and App directories are core parts of the configuration hierarchy.

Answer

$SPLUNK_HOME/var/run

Answer

$SPLUNK_HOME/etc/licenses

Answer

$SPLUNK_HOME/etc/users/admin

Question 5

To monitor a network port using a Universal Forwarder, which stanza should be added to inputs.conf?

Accepted Answer

[tcp://9997]. TCP and UDP inputs require the [tcp://] or [udp://] stanza in inputs.conf.

Answer

[script://./bin/my.py]

Answer

[monitor:///var/log/]

Answer

[winhost://]

Question 6

What is the purpose of the 'whitelist' and 'blacklist' attributes in a serverclass.conf file?

Accepted Answer

To filter which forwarders receive the app.. These attributes filter which clients receive specific deployment apps.

Answer

To prevent unauthorized users from accessing the UI.

Answer

To filter the types of logs collected.

Answer

To limit the network bandwidth usage.

Question 7

Which TWO settings in outputs.conf are recommended for load balancing data across multiple indexers?

Accepted Answer

autoLBFrequency. To balance load, one must provide a list of indexers and define the autoLB frequency.

Answer

serverName

Answer

sslPassword

Answer

index

Question 8

You have defined a setting in $SPLUNK_HOME/etc/system/local/inputs.conf and the same setting exists in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf. Which value takes precedence?

Accepted Answer

The app/local value. App-level local directory configurations override system-level local configurations.

Answer

The system/local value

Answer

The configuration with the most recent timestamp

Answer

The configuration alphabetically first

Question 9

What is the effect of setting 'TRANSFORMS-routing' in props.conf?

Accepted Answer

It invokes a named transform from transforms.conf. It instructs Splunk to process the data using a specific transform defined in transforms.conf.

Answer

It routes the data to a specific app

Answer

It triggers an alert

Answer

It changes the sourcetype

Question 10

What happens if you have a syntax error in a .conf file?

Accepted Answer

The configuration will be ignored and a warning logged. Splunk generally skips the malformed stanza or the entire file, depending on the severity, often logging a warning in splunkd.log.

Answer

The system halts immediately

Answer

It is ignored silently

Answer

Splunk will automatically fix the syntax