SPLK-1003 Practice Test 13 — 15 Questions

Question 1

Which THREE of the following are components of a standard Splunk architecture?

Accepted Answer

Universal Forwarder. Indexers, Search Heads, and Forwarders are the core components of Splunk architecture.

Answer

Database Server

Answer

Web Server

Question 2

You need to restrict a specific user from accessing the 'internal' index even though their assigned role has access to all indexes. How do you implement this restriction?

Accepted Answer

Create a new role with 'srchIndexesAllowed' excluding 'internal' and assign this role to the user.. You must create a new role that explicitly excludes the 'internal' index in the 'srchIndexesAllowed' field and assign it to the user.

Answer

Use a 'blacklist' in authorize.conf for the specific user.

Answer

Modify the user's account and set the indexes access to 'none'.

Answer

Set the 'allow_index_access' capability to false for the user.

Question 3

Which THREE of the following are true about the 'can_delete' capability?

Accepted Answer

It allows the use of the 'delete' command.. The 'can_delete' capability is a powerful tool requiring specific assignment and usage restrictions to prevent accidental data loss.

Answer

It requires the user to be an LDAP admin.

Answer

It allows a user to delete the Splunk license.

Question 4

You need to modify the retention of a specific index without affecting others. Where should you make this change in a distributed environment?

Accepted Answer

On the Indexer via the Deployment Server.. You should use the configuration management tool (like the Deployment Server or Cluster Master) to push the indexes.conf change to the indexers.

Answer

In the local.meta file.

Answer

In the web UI on the License Master.

Answer

On the Search Head.

Question 5

A Universal Forwarder is failing to send data to the Indexer. The indexer shows no incoming traffic. Where is the first place you should check for errors?

Accepted Answer

$SPLUNK_HOME/var/log/splunk/splunkd.log. The splunkd.log on the forwarder contains logs regarding connectivity and data sending issues.

Answer

The Splunk Web UI on the Indexer

Answer

$SPLUNK_HOME/etc/system/local/inputs.conf

Answer

$SPLUNK_HOME/etc/apps/search/local/indexes.conf

Question 6

Which TWO components must be configured on a Universal Forwarder to ensure data reaches the Indexer?

Accepted Answer

outputs.conf. A forwarder needs to know what to collect (inputs.conf) and where to send it (outputs.conf).

Answer

props.conf

Answer

indexes.conf

Answer

web.conf

Question 7

You are troubleshooting a file input that is not being ingested. You have verified the file path. Which command-line tool can show you if the file is being tracked by the monitor input?

Accepted Answer

splunk list monitor. The 'splunk list monitor' command shows the status of currently tracked files.

Answer

splunk check files

Answer

splunk debug input

Answer

splunk show inputs

Question 8

Which TWO of the following are true about Heavy Forwarders?

Accepted Answer

They can route data based on content.. Heavy Forwarders can perform indexing (if enabled) and parsing, which UFs cannot.

Answer

They consume less resources than UFs.

Answer

They cannot connect to a deployment server.

Answer

They are deprecated.

Question 9

A company is migrating from an Enterprise license to a Free license. What is the most significant functional impact on their Splunk deployment?

Accepted Answer

Authentication and roles are disabled.. The Free license disables authentication, meaning all users are logged in as admin by default.

Answer

Distributed search is enabled by default.

Answer

The maximum daily indexing volume is increased.

Answer

Data retention is extended to 90 days.

Question 10

Which THREE of the following are valid components of a Splunk license configuration?

Accepted Answer

License Slave. License masters, slaves, and pools are all integral parts of a managed license deployment.

Answer

License Forwarder

Answer

License Alert Manager

Question 11

Which Splunk process is responsible for the actual indexing of data on the indexer?

Accepted Answer

splunkd. Splunkd is the main daemon responsible for all core Splunk functionality, including indexing.

Answer

splunkweb

Answer

mongod

Answer

splunk-optimize

Question 12

You need to ensure that specific data is retained for 365 days. Which parameter in indexes.conf controls this?

Accepted Answer

frozenTimePeriodInSecs. 'frozenTimePeriodInSecs' defines the duration in seconds that data stays in an index before being moved to frozen/deleted.

Answer

retentionPeriodDays

Answer

coldPathRetention

Answer

maxDataSize

Question 13

Which THREE of the following items are considered Knowledge Objects in Splunk?

Accepted Answer

Saved searches.. Saved searches, dashboards, and alerts are all standard Splunk Knowledge Objects.

Answer

Network cables.

Answer

Hard drives.

Question 14

Which menu path in Splunk Web is used to manage existing user roles?

Accepted Answer

Settings > Access controls > Roles. Settings > Access controls > Roles is the path to manage roles.

Answer

Settings > Authentication method

Answer

Settings > Server settings

Answer

Settings > Access controls > Users

Question 15

Which THREE types of bucket states exist in a healthy Splunk indexer?

Accepted Answer

Warm. Hot, Warm, and Cold are the standard active states for data buckets in an index.

Answer

Evaporated

Answer

Simmer