SPLK-1003 Practice Test 19 — 15 Questions

Question 1

A Splunk administrator has deployed a new search head and wants to confirm that the license slave can reach the license manager on TCP port 8089. Which file should the administrator inspect to verify the license manager URI configured on the search head?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

server.conf. License manager addressing on a Splunk instance is configured in the [license] stanza of server.conf through the manager_uri setting. Verifying that value lets the administrator confirm the host and port the search head will contact, which is essential before diagnosing a license slave that cannot reach the license manager.

Answer

outputs.conf

Answer

inputs.conf

Answer

indexes.conf

Question 2

Which TWO settings are commonly required when configuring an LDAP strategy?

Accepted Answer

LDAP Group mapping filter. Option D (LDAP Group mapping filter) is correct because an LDAP strategy must define how directory groups are matched and mapped to Splunk roles, typically via a group base DN and a group search filter such as (objectClass=group) or (memberOf=...), so that group membership drives role assignment. Option E (User Base DN) is correct because the strategy needs the distinguished name under which user entries reside (for example, ou=People,dc=example,dc=com) so Splunk can bind and search for authenticating users. Option A is wrong because the local Splunk indexer password is unrelated to directory authentication and is not part of an LDAP strategy. Option B is wrong because browser cache TTL is a web/client-side setting, not an LDAP authentication parameter. Option C is wrong because the LDAP server's disk space is an infrastructure concern, not a configurable field in the LDAP strategy.

Answer

The local Splunk indexer password.

Answer

Browser cache TTL.

Answer

The LDAP server's disk space.

Question 3

A Splunk administrator is configuring a Universal Forwarder to monitor a directory that contains log files rotated daily. The administrator wants to ensure that only files with a .log extension are ingested and that files older than 7 days are ignored. Which configuration in inputs.conf accomplishes this?

Accepted Answer

[monitor:///var/log/myapp] whitelist = \.log$ ignoreOlderThan = 7d. The correct configuration uses whitelist to include only .log files and ignoreOlderThan to skip files older than 7 days. whitelist filters based on filename, while ignoreOlderThan uses the file's modification time to exclude stale files. Together, they ensure only recent .log files are ingested, meeting both conditions efficiently.

Answer

[monitor:///var/log/myapp] whitelist = \.log$ blacklist = \.(\d{8})$

Answer

[monitor:///var/log/myapp] blacklist = \.log$ ignoreOlderThan = 7d

Answer

[monitor:///var/log/myapp] whitelist = \.log$ followTail = 0

Question 4

A Splunk administrator is configuring LDAP authentication and needs to ensure that only users who are members of the 'SplunkAdmins' group in Active Directory can log in. The LDAP strategy has been set up with a User Base DN and a bind account. Which additional setting must be configured to enforce this restriction?

Accepted Answer

Configure a 'User Filter' that includes a membership condition for the 'SplunkAdmins' group.. To restrict LDAP authentication to members of a specific group, you must modify the User Filter to include a group membership condition. This filter is applied during the user search phase of authentication, so only users matching the filter will be found and allowed to log in. Other settings like Group Base DN, role mapping, or Bind DN do not enforce login restrictions based on group membership.

Answer

Set the 'Bind DN' to a user account that is a member of the 'SplunkAdmins' group.

Answer

Set the 'Group Base DN' to the distinguished name of the 'SplunkAdmins' group.

Answer

Enable 'Role Mapping' and map the 'SplunkAdmins' group to the admin role.

Question 5

Which TWO settings in indexes.conf are used to control the rotation of hot buckets?

Accepted Answer

maxHotSpanSecs. In indexes.conf, hot bucket rotation is governed by two settings: maxHotSpanSecs (B), which forces a hot bucket to roll to warm once its age exceeds the specified number of seconds, and maxDataSize (E), which forces a hot bucket to roll once it reaches the specified size (e.g., auto, auto_high_volume, or an explicit byte value). Together these control the time-based and size-based triggers for hot-to-warm rolling. frozenTimePeriodInSecs (A) controls the frozen (retention) policy for the oldest data, not hot bucket rotation. maxTotalDataSizeMB (C) sets the total index size limit that triggers freezing of the oldest buckets, not hot rotation. coldPath (D) merely specifies the directory where cold buckets are stored and has no effect on rotation.

Answer

frozenTimePeriodInSecs

Answer

maxTotalDataSizeMB

Answer

coldPath

Question 6

You need to ensure that an index does not exceed 500GB of total disk space. Which configuration setting in indexes.conf should you modify?

Accepted Answer

maxTotalDataSizeMB. The maxTotalDataSizeMB setting in indexes.conf specifies the maximum total size of all data in the index (including both hot/warm and cold buckets) before the oldest data is frozen (deleted or archived). Setting this to 500000 (500GB) ensures the index does not exceed that disk space.

Answer

maxDataSize

Answer

frozenTimePeriodInSecs

Answer

homePath.maxDataSizeMB

Question 7

What is the consequence of having the same 'serverName' in server.conf for two different Universal Forwarders?

Accepted Answer

Splunk will merge data metrics for both forwarders in internal reports.. The serverName in server.conf is used as the unique identifier for a Splunk instance in internal metrics and licensing. If two Universal Forwarders share the same serverName, Splunk cannot distinguish them, so their data metrics (such as indexing throughput and license usage) are merged and attributed to a single identity in internal reports like the license usage report.

Answer

The Indexer will block both connections.

Answer

The forwarders will immediately stop sending data.

Answer

The second forwarder will fail to start.

Question 8

If a user is assigned to a role that does not have the 'license_tab' capability, what will they see in the Settings menu?

Accepted Answer

The Licensing menu item will be hidden.. Splunk hides UI elements that a user's role does not have the capability to access. If the role lacks the 'license_tab' capability, the Licensing menu item in Settings is not rendered at all — the user simply does not see it. Splunk's UI is capability-driven, so absence of a capability means absence of the corresponding menu entry.

Answer

They will be prompted for admin credentials.

Answer

They will see the menu but it will be greyed out.

Answer

They will see the menu but receive an error on click.

Question 9

An administrator is reviewing license usage on a license master and notices that several indexers are reporting indexing volumes that exceed their pool quotas. The administrator needs to take corrective actions to avoid search being blocked. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Reassign indexers to different pools to balance the indexing load.. To resolve recurring license violations, the administrator can increase the overall license volume by installing a new license key, or reassign indexers to different pools to better balance the load. Both actions address the root cause by ensuring indexing volume stays within licensed limits, preventing search from being blocked.

Answer

Configure the indexers to use the free license to avoid violations.

Answer

Disable indexing on the offending indexers until the next license period.

Answer

Restart the license master to reset the violation counters.

Question 10

A Splunk administrator is configuring a Universal Forwarder to send data to an indexer cluster. The administrator wants to ensure that the forwarder can continue to send data if the primary indexer becomes unavailable, and that data is load-balanced across multiple indexers. Which configuration should be implemented?

Accepted Answer

Configure outputs.conf with a [tcpout] stanza that lists multiple indexers in the server attribute and set autoLB = true.. To achieve both load balancing and failover, the forwarder must have multiple indexers listed in the server attribute and autoLB set to true. This allows the forwarder to distribute data across all indexers and continue sending if one fails. The other options either lack multiple indexers, disable load balancing, or use separate output groups that do not provide the needed redundancy.

Answer

Configure outputs.conf with multiple [tcpout] stanzas, each with a single server, and set useACK = true.

Answer

Configure outputs.conf with a [tcpout] stanza that lists multiple indexers in the server attribute and set autoLB = false.

Answer

Configure outputs.conf with a single [tcpout] stanza containing one server entry and set autoLB = true.

Question 11

After installing a new app, you notice that the app's dashboards are not appearing in the user's view. What is the first thing you should check?

Accepted Answer

The app permissions in 'Manage Apps'.. When an app's dashboards don't appear for a user, the most likely cause is that the app's objects (including dashboards) are not shared with the appropriate roles or users. Checking the app permissions in 'Manage Apps' (or the app's object permissions) is the first step to verify whether the dashboards are visible to that user's role.

Answer

The server license status.

Answer

The splunkd logs for critical errors.

Answer

The indexer cluster master status.

Question 12

You are configuring SAML authentication and need to map the 'email' attribute from the Identity Provider to the Splunk 'realName' field. Where do you configure this?

Accepted Answer

SAML Configuration in Splunk Web.. SAML attribute mapping (including mapping the IdP's 'email' attribute to Splunk's realName field) is configured in the SAML Configuration page under Settings > Authentication Method in Splunk Web. This UI writes the mapping to authentication.conf.

Answer

server.conf

Answer

authorize.conf

Answer

web.conf

Question 13

A Splunk administrator is configuring a new search head cluster and needs to ensure that knowledge objects (such as saved searches and dashboards) are replicated across all members. Which configuration file and setting must be used to define the replication factor for the search head cluster?

Accepted Answer

server.conf, [shclustering] stanza, replication_factor. Search head cluster replication factor is defined in server.conf within the [shclustering] stanza using the replication_factor setting. This controls how many copies of each knowledge object are stored across the cluster. The other options either reference the wrong file, wrong stanza, or an invalid setting name. Correct configuration ensures high availability of knowledge objects.

Answer

indexes.conf, [shclustering] stanza, replication_factor

Answer

server.conf, [shclustering] stanza, replication_factor_search

Answer

server.conf, [replication_port] stanza, shcluster_replication_factor

Question 14

An administrator notices that search is blocked on several indexers due to license violations. The administrator has already resolved the underlying issue that caused the excessive indexing. What is the correct sequence of actions to restore search functionality?

Accepted Answer

Use the license master's UI to acknowledge the violation and reset the violation count.. To restore search after license violations, the administrator must acknowledge the violation on the license master. This resets the violation count and unblocks search. The acknowledgment is done via the licensing UI or CLI, and it should only be performed after the root cause of the violation has been fixed to prevent recurrence.

Answer

On the license master, run the CLI command 'splunk reset licenser' to clear violations.

Answer

Wait 24 hours; search will automatically be restored after the violation period expires.

Answer

Restart the indexers to clear the violation state.

Question 15

What is the default role assigned to a new user account if no other role is specified?

Accepted Answer

user. In Splunk, when a new user account is created without explicitly assigning any role, the system automatically assigns the 'user' role by default. This role provides basic capabilities such as running searches, creating and managing their own saved searches, and using the Splunk Web interface, but it does not grant administrative privileges or the ability to delete data. The 'user' role is the standard starting point for most non-admin users.

Answer

admin

Answer

power

Answer

can_delete