SPLK-1003 Practice Test 2 — 10 Questions

Question 1

You are configuring LDAP authentication for Splunk Enterprise. You want to ensure that users are authenticated against the LDAP directory and that their group memberships are mapped to Splunk roles. Which two configuration settings must you define in authentication.conf to achieve this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

groupBaseDN. To authenticate users via LDAP and map their group memberships to Splunk roles, you must specify the userBaseDN to locate user accounts and the groupBaseDN to locate groups. These settings enable Splunk to search the directory for users and groups, and then use the roleMap to assign roles based on group membership.

Answer

bindDN

Answer

srvBaseDN

Answer

roleBaseDN

Question 2

When using the 'monitor' stanza in inputs.conf, what does the 'followTail' attribute do?

Accepted Answer

Ingests only new data arriving after the monitor is started.. followTail ensures that only new data appended to the file is ingested, ignoring existing content.

Answer

Compresses the file.

Answer

Ingests the entire file immediately.

Answer

Deletes the file after reading.

Question 3

If you want to move the index data directory to a new partition, what setting in indexes.conf must be updated?

Accepted Answer

homePath. The homePath setting in indexes.conf specifies the directory where the index's data is stored. To move the index data directory to a new partition, you must update homePath to point to the new location. This setting is critical for relocating index data.

Answer

dataDir

Answer

maxTotalDataSizeMB

Answer

indexPool

Question 4

An administrator wants to view the current license usage and see which indexers are reporting to the license master. Which Splunk Web page should the administrator navigate to?

Accepted Answer

Settings > Licensing. In Splunk Web, license usage and the list of indexers reporting to the license master are found under Settings > Licensing. This page provides a comprehensive view of license consumption, including daily volume, quota, and violations. Other pages under Settings, such as Indexers, Server Settings, and Distributed Search, serve different purposes and do not display license information.

Answer

Settings > Server Settings

Answer

Settings > Distributed Search

Answer

Settings > Indexers

Question 5

A Splunk administrator is configuring SAML authentication for the company's Splunk Enterprise deployment. The Identity Provider (IdP) sends a group attribute named 'memberOf' containing the value 'CN=SplunkPowerUsers,OU=Groups,DC=corp,DC=local'. The administrator needs this group to automatically map to the 'power' role in Splunk. Which configuration file and stanza should the administrator edit to accomplish this?

Accepted Answer

authentication.conf, under the [roleMap_SAML] stanza with the attribute 'power = CN=SplunkPowerUsers,OU=Groups,DC=corp,DC=local'. SAML group-to-role mapping in Splunk Enterprise is configured in authentication.conf within a [roleMap_SAML] stanza, where each entry pairs a Splunk role with one or more IdP group values. This allows automatic role assignment at login based on the IdP's group assertion. The [saml] stanza handles identity provider connection details, while authorize.conf defines role capabilities, not SAML mappings.

Answer

authentication.conf, under the [saml] stanza with the attribute 'roleMap'

Answer

web.conf, under the [settings] stanza with the attribute 'samlRoleMapping'

Answer

authorize.conf, under the [role_power] stanza with the attribute 'samlGroup'

Question 6

Which TWO of the following are valid ways to monitor the status of a Splunk instance?

Accepted Answer

Running the 'splunk status' command.. Option D is correct because the 'splunk status' CLI command queries the local splunkd process and reports whether Splunk is running, along with PID and component status, making it a standard supported method to monitor instance health. Option E is correct because the Monitoring Console app in Splunk Web provides a centralized, supported dashboard for monitoring the health, performance, and status of Splunk instances, including indexers, search heads, and forwarders. Option A is incorrect because /tmp lock files are not a documented or reliable status indicator and their presence does not reflect Splunk's operational state. Option B is incorrect because indexer cluster raw binary data (bucket files) is internal storage, not a monitoring interface, and reading it does not report instance status. Option C is incorrect because pinging a forwarder's local web port does not validate Splunk's status and forwarders typically do not run Splunk Web by default.

Answer

Checking the /tmp directory for lock files.

Answer

Reading the indexer cluster's raw binary data.

Answer

Pinging the forwarder's local web port.

Question 7

Which TWO components must be configured on a Universal Forwarder to ensure data reaches the Indexer?

Accepted Answer

outputs.conf. On a Universal Forwarder, inputs.conf (option E) is required to define what data to collect — for example, a [monitor://] stanza specifying the file or directory to watch — so without it the forwarder has nothing to send. outputs.conf (option A) is equally required because it defines the destination indexer(s), typically via [tcpout] with server=<host>:9997 and defaultGroup settings, so the collected data knows where to go. Together these two files satisfy the forwarder's core job of reading data and forwarding it to the indexer. props.conf (option B) is optional on a forwarder and only used for parsing/sourcetype handling, not for routing data. indexes.conf (option C) is an indexer-side configuration defining index storage paths and retention, not needed on a forwarder. web.conf (option D) configures Splunk Web settings and is irrelevant to forwarding data.

Answer

props.conf

Answer

indexes.conf

Answer

web.conf

Question 8

A security team requires that all Splunk users authenticate through your corporate LDAP directory, but they also need a local break-glass account in case LDAP becomes unreachable. You configure LDAP authentication in Splunk Web. Which action ensures the local administrator account can still log in when the LDAP servers are down?

Accepted Answer

Configure LDAP as the authentication scheme and ensure the local administrator account has a password set and is not disabled.. Selecting LDAP as the authentication scheme routes normal logins to the directory, but Splunk retains local accounts that have a password and are enabled. The built-in admin account is local by default, so setting its password and leaving it enabled provides emergency access if LDAP is unreachable. This is the documented method for maintaining a local fallback while using an external authentication scheme.

Answer

Enable the 'Allow local users' option under LDAP settings and map the local administrator to an LDAP group.

Answer

Create a second authentication scheme entry for 'Splunk' and set it as the default, then add LDAP as a secondary scheme.

Answer

Add the local administrator to the 'admin' role and leave the default authentication scheme as 'Splunk'.

Question 9

If you need to change the logging level of a specific component on a Universal Forwarder, which file should you edit?

Accepted Answer

log-local.cfg. log-local.cfg is the per-instance logging configuration file used to override logging levels for specific components without affecting the global log.cfg. On a Universal Forwarder, editing $SPLUNK_HOME/etc/system/local/log-local.cfg (or the app-specific copy) lets you raise or lower verbosity for a named component such as the tailing processor or the deployment client. Changes take effect after a forwarder restart or a debug refresh.

Answer

server.conf

Answer

outputs.conf

Answer

inputs.conf

Question 10

Which TWO of the following are valid ways to configure inputs on a Universal Forwarder?

Accepted Answer

Editing inputs.conf manually. Option A is correct because inputs.conf is the primary configuration file on a Universal Forwarder, and manually editing it (typically under $SPLUNK_HOME/etc/system/local/ or an app's local directory) is a fully supported way to define inputs such as [monitor://], [tcp://], or [udp://] stanzas. Option B is correct because the 'splunk add monitor' CLI command (e.g., 'splunk add monitor /var/log') is a valid, supported method that writes the corresponding stanza into inputs.conf on the Universal Forwarder. Option C is incorrect because outputs.conf defines where the forwarder sends data (indexers, via [tcpout] settings), not what data it collects. Option D is incorrect because the Indexer UI is used for searching and managing the indexer, not for configuring inputs on a separate Universal Forwarder, which has no full web UI for input management. Option E is incorrect because the License Master API concerns license management and has nothing to do with defining data inputs on a forwarder.

Answer

Editing outputs.conf

Answer

Using the Indexer UI web interface

Answer

Using the License Master API