SPLK-1003 Practice Test 16 — 15 Questions

Question 1

Which TWO items are contained within an 'authorize.conf' role stanza?

Accepted Answer

srchIndexesAllowed. Authorize.conf stanzas define the specific index access and capability set for a role.

Answer

User password hash

Answer

UI theme setting

Answer

LDAP Group mapping

Question 2

If a user is assigned to a role that does not have the 'license_tab' capability, what will they see in the Settings menu?

Accepted Answer

The Licensing menu item will be hidden.. The 'license_tab' capability controls visibility of the Licensing menu item in Settings.

Answer

They will be prompted for admin credentials.

Answer

They will see the menu but it will be greyed out.

Answer

They will see the menu but receive an error on click.

Question 3

A user inherits roles 'RoleA' and 'RoleB'. 'RoleA' has 'srchIndexesAllowed' set to 'index1' and 'RoleB' has it set to 'index2'. What indexes can the user access?

Accepted Answer

Both index1 and index2.. When roles are combined, the cumulative set of allowed indexes is the union of all indexes allowed by all assigned roles.

Answer

Only index1.

Answer

Only index2.

Answer

No indexes.

Question 4

Which of the following is a valid method to restart the Splunk service on a Linux system?

Accepted Answer

/opt/splunk/bin/splunk restart. The standard system-level command for restarting Splunk is '/opt/splunk/bin/splunk restart'.

Answer

service splunk stop && service splunk start

Answer

/opt/splunk/bin/splunk reload

Answer

kill -9 $(pidof splunkd)

Question 5

Which THREE capabilities are typically assigned to a 'Power User'?

Accepted Answer

rtsearch. Power users typically have abilities to edit shared objects, perform real-time searches, and manage saved searches.

Answer

admin_all_objects

Answer

edit_tcp

Question 6

Which THREE of these represent common issues when troubleshooting LDAP authentication?

Accepted Answer

Incorrect User Search Filter. Incorrect bind credentials, incorrect search filters, and mapping issues are the most frequent causes of LDAP failure.

Answer

The user's local disk is full.

Answer

Browser cookie expiration

Question 7

An administrator needs to install a new technology add-on on a standalone Search Head. Which menu path in Splunk Web is used to perform this action?

Accepted Answer

Settings -> Apps -> Install app from file. Apps -> Manage Apps -> Install app from file is the standard path in Splunk Web.

Answer

Settings -> Forwarder Management

Answer

Settings -> Data Inputs -> Add new

Answer

Settings -> Server Settings -> System Settings

Question 8

If you want to move the index data directory to a new partition, what setting in indexes.conf must be updated?

Accepted Answer

homePath. The 'homePath' (or 'coldPath'/'thawedPath') defines the physical location of the data on the disk.

Answer

dataDir

Answer

maxTotalDataSizeMB

Answer

indexPool

Question 9

Which THREE of the following actions can be performed from the 'Settings' menu in Splunk Web?

Accepted Answer

Manage user roles.. Settings includes access to indexes, knowledge objects, and licensing.

Answer

Write raw C++ code for the Splunk engine.

Answer

Restart the physical OS.

Question 10

If a user is assigned two roles, 'RoleA' and 'RoleB', and 'RoleA' has 'rtsearch' enabled while 'RoleB' has 'rtsearch' disabled, what is the user's effective capability for real-time searches?

Accepted Answer

The user can perform real-time searches.. Capabilities in Splunk are additive; if any assigned role has the capability, the user possesses that capability.

Answer

The user can only perform real-time searches on index 'main'.

Answer

The user cannot perform real-time searches.

Answer

The user is prompted to choose which role to act as.

Question 11

What is the effect of setting 'allow_debug' to false in a role?

Accepted Answer

The user cannot use the debug tools in the search bar.. The 'allow_debug' capability enables the use of the debug tools in the search bar. Disabling it restricts this functionality.

Answer

The user cannot log in.

Answer

The user cannot export data.

Answer

The user cannot save searches.

Question 12

An administrator needs to increase the number of search results displayed in a dashboard panel. Where can this limit be adjusted?

Accepted Answer

limits.conf. limits.conf contains global search limits including 'maxresults'.

Answer

props.conf

Answer

authorize.conf

Answer

savedsearches.conf

Question 13

Which THREE of the following configurations can be performed in props.conf?

Accepted Answer

Specifying timestamp extraction rules.. props.conf manages sourcetype definitions, timestamping, and field extractions.

Answer

Setting index retention periods.

Answer

Configuring TCP input ports.

Question 14

Which of the following is a 'capability' in Splunk?

Accepted Answer

edit_own_objects. 'edit_own_objects' is a built-in capability that allows users to modify their own saved searches and dashboards.

Answer

SAML_Auth

Answer

Modify User.

Answer

View Index.

Question 15

An administrator wants to ensure that a specific role cannot search over a time range greater than 24 hours. Where is this limit configured?

Accepted Answer

authorize.conf. The 'srchTimeWin' attribute in the role definition within authorize.conf restricts the maximum search time window.

Answer

limits.conf

Answer

server.conf

Answer

authentication.conf