SPLK-1003 Practice Test 14 — 15 Questions

Question 1

Which TWO of the following are true regarding the Splunk Free license?

Accepted Answer

Authentication is disabled.. The Free license has no authentication and is limited to 500MB per day.

Answer

It includes Splunk Enterprise features.

Answer

It supports multiple user roles.

Answer

It supports distributed search.

Question 2

Which user account is created by default and intended for administrative use, which should have its default password changed immediately?

Accepted Answer

admin. The 'admin' user is the default superuser account.

Answer

root

Answer

manager

Answer

splunk-system

Question 3

Which file in the index directory contains the bucket's metadata?

Accepted Answer

bucket.meta. The journal.gz and the corresponding .meta files contain the metadata for the events in the bucket.

Answer

rawdata

Answer

journal.gz

Answer

index.conf

Question 4

What command is used to check the health and integrity of an index bucket?

Accepted Answer

splunk fsck. The 'splunk fsck' command is designed to perform file system checks on buckets.

Answer

splunk status

Answer

splunk check

Answer

splunk validate

Question 5

Where does an administrator configure the License Master URL for an indexer?

Accepted Answer

In the server.conf file.. The URL is configured in the server.conf file of the indexer (the slave).

Answer

In the license.conf file.

Answer

In the web.conf file.

Answer

In the Splunk Web UI under Licensing.

Question 6

Which TWO of the following are required to successfully add an indexer to a license pool?

Accepted Answer

The indexer must be configured to point to the license master.. The indexer must point to the master, and the master must have the pool defined to accept that indexer.

Answer

The license key must be unique per pool.

Answer

The indexer must be a license master.

Answer

The indexer must be in the same subnet as the master.

Question 7

Which TWO of the following are true regarding the configuration of multiple license pools?

Accepted Answer

Slaves can be assigned to exactly one pool.. Pools allow for dividing the total capacity, but the sum of pool quotas cannot exceed the total license volume.

Answer

Pools only function on indexer clusters.

Answer

Each pool requires its own unique license file.

Answer

The total quota of all pools can exceed the total license volume.

Question 8

You are configuring a Universal Forwarder to send logs to an Indexer Cluster. Where should you define the outputs.conf file to ensure the forwarder correctly balances traffic across all indexers?

Accepted Answer

$SPLUNK_HOME/etc/system/local/. The outputs.conf file on the Universal Forwarder should contain the indexer cluster master's discovery URI to obtain the indexer list.

Answer

$SPLUNK_HOME/etc/system/default/

Answer

$SPLUNK_HOME/etc/manager/local/

Answer

$SPLUNK_HOME/etc/apps/search/local/

Question 9

After installing a new app, you notice that the app's dashboards are not appearing in the user's view. What is the first thing you should check?

Accepted Answer

The app permissions in 'Manage Apps'.. If the app is installed but not visible, the user's permissions for the app or the dashboard objects are likely missing.

Answer

The server license status.

Answer

The splunkd logs for critical errors.

Answer

The indexer cluster master status.

Question 10

Where are the local configuration files for an installed app located?

Accepted Answer

$SPLUNK_HOME/etc/apps/<app_name>/local/. App-specific local configurations are located in the local/ directory within the app folder.

Answer

/var/log/splunk/

Answer

$SPLUNK_HOME/etc/system/local/

Answer

$SPLUNK_HOME/etc/apps/<app_name>/default/

Question 11

When configuring an index, which setting determines the directory where 'cold' buckets are stored?

Accepted Answer

coldPath. The coldPath setting in indexes.conf explicitly defines the location for cold data.

Answer

thawedPath

Answer

homePath

Answer

frozenPath

Question 12

When a Splunk license violation occurs, how long does the warning period last before search is blocked?

Accepted Answer

14 days. The warning period for a license violation is typically 14 days, allowing the admin to resolve the overage.

Answer

30 days

Answer

3 days

Answer

7 days

Question 13

An administrator needs to identify which indexer is responsible for a license violation. Where should they check?

Accepted Answer

The License Master's usage report.. The License Master's monitoring page displays usage per slave (indexer).

Answer

The license slave's internal logs.

Answer

The search head's search logs.

Answer

The forwarder's metrics.log.

Question 14

You are troubleshooting a connection issue from a forwarder to an indexer. Which log file on the indexer would best show connection attempts from forwarders?

Accepted Answer

splunkd.log. splunkd.log is the main log file that records all network connection events and errors for the Splunk service.

Answer

audit.log

Answer

web_service.log

Answer

metrics.log

Question 15

Which TWO of the following are true regarding Indexer Clustering?

Accepted Answer

It allows search heads to search across all indexers.. Indexer clusters use a master to coordinate replication and ensure high availability.

Answer

It eliminates the need for any forwarders.

Answer

It automatically handles the installation of Splunk software.

Answer

The Master node performs the actual indexing.