SPLK-1003 Practice Test 12 — 15 Questions

Question 1

You are configuring a Heavy Forwarder to mask sensitive credit card information before the data reaches the indexer. Which configuration file must you modify to implement this data transformation?

Accepted Answer

transforms.conf. Data transformations such as routing, filtering, and masking occur on the Heavy Forwarder via transforms.conf and props.conf.

Answer

server.conf

Answer

inputs.conf

Answer

outputs.conf

Question 2

What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?

Accepted Answer

It prevents the input from running. The disabled attribute is used to stop an input from running without deleting the configuration.

Answer

It errors out if the input is not found

Answer

It deletes the input

Answer

It hides the input from the UI

Question 3

Where is the global configuration for Splunk Enterprise stored?

Accepted Answer

$SPLUNK_HOME/etc/system/local/. $SPLUNK_HOME/etc/system/local is the location for global, system-wide configuration overrides.

Answer

$SPLUNK_HOME/etc/users/

Answer

$SPLUNK_HOME/var/lib/

Answer

$SPLUNK_HOME/etc/apps/

Question 4

Which TWO of the following are true about 'local' versus 'default' directories?

Accepted Answer

'local' files are preserved during Splunk upgrades. Local overrides default, and local is where changes should be made to survive upgrades.

Answer

Files in 'default' should be edited to update Splunk settings

Answer

'local' directories only exist in the system folder

Answer

'default' files take precedence over 'local'

Question 5

You are configuring a scripted input to run a python script. Where is the best location to store this script on a Universal Forwarder?

Accepted Answer

$SPLUNK_HOME/etc/apps/my_app/bin/. Scripts should reside within an app directory to ensure they are handled correctly by the deployment server and permissions.

Answer

$SPLUNK_HOME/var/run/

Answer

/opt/scripts/

Answer

/tmp/

Question 6

Which protocol is the default used by Splunk Universal Forwarders to communicate with Indexers?

Accepted Answer

S2S (Splunk-to-Splunk). Splunk uses the Splunk-to-Splunk (S2S) protocol, typically over TCP/9997.

Answer

Syslog

Answer

HTTP

Answer

SNMP

Question 7

Which Splunk component should be used to distribute configuration files to a large fleet of Universal Forwarders?

Accepted Answer

Deployment Server. The Deployment Server is the primary mechanism for centralizing and pushing configuration updates to forwarders.

Answer

Heavy Forwarder

Answer

Indexer Cluster Master

Answer

Search Head Cluster Deployer

Question 8

An administrator finds that search performance for a specific index is slow. What should they check regarding index buckets?

Accepted Answer

The number of buckets and their individual sizes.. If buckets are too large or fragmented (too many small buckets), search performance suffers due to high IOPS or excessive file handles.

Answer

The operating system's kernel version.

Answer

The indexer's CPU count.

Answer

The license master's time synchronization.

Question 9

Which THREE features are associated with Indexer Clustering?

Accepted Answer

Cluster Master.. Clustering involves bucket replication, search affinity, and the Cluster Master/Manager to manage the state.

Answer

Data model encryption.

Answer

Universal forwarder load balancing.

Question 10

You need to perform a regex-based routing operation to send data to different indexes based on the host. Which file must be configured to define the routing regex?

Accepted Answer

transforms.conf. transforms.conf is where the regex logic resides, while props.conf references the transform.

Answer

indexes.conf

Answer

props.conf

Answer

inputs.conf

Question 11

You need to ensure that specific data is sent to a specific indexer using the outputs.conf file. Which stanza is used for this?

Accepted Answer

[tcpout]. The [tcpout] stanza is used in outputs.conf to define forwarding destinations.

Answer

[index]

Answer

[forwarder]

Answer

[indexer]

Question 12

Which THREE of the following are true regarding the configuration precedence of apps?

Accepted Answer

You can use app.conf to control the precedence of apps. App precedence is determined by the order in which they are loaded, which can be controlled in app.conf, and they override the system default.

Answer

User settings are less important than app settings

Answer

App precedence is defined by the directory order in etc/apps

Question 13

Which TWO of the following locations are valid for placing a custom 'inputs.conf' file?

Accepted Answer

$SPLUNK_HOME/etc/apps/my_app/local/. Custom configs should be placed in local directories to follow best practices.

Answer

$SPLUNK_HOME/etc/system/default/

Answer

$SPLUNK_HOME/var/lib/

Answer

$SPLUNK_HOME/etc/apps/my_app/default/

Question 14

What is the consequence of having the same 'serverName' in server.conf for two different Universal Forwarders?

Accepted Answer

Splunk will merge data metrics for both forwarders in internal reports.. Splunk uses the serverName to uniquely identify internal logs; duplicate names cause conflicts in the monitoring console.

Answer

The Indexer will block both connections.

Answer

The forwarders will immediately stop sending data.

Answer

The second forwarder will fail to start.

Question 15

Which TWO of the following are valid ways to configure inputs on a Universal Forwarder?

Accepted Answer

Editing inputs.conf manually. Inputs can be managed via the CLI or by manually editing configuration files in the local directory.

Answer

Editing outputs.conf

Answer

Using the Indexer UI web interface

Answer

Using the License Master API