SPLK-1003 Practice Exam 2 — 20 Questions

Question 1

You notice that data is being indexed with the wrong timestamp. Which configuration file is used to specify timestamp extraction rules?

Accepted Answer

props.conf. The TIME_PREFIX and TIME_FORMAT settings in props.conf determine how Splunk parses timestamps from raw logs.

Answer

indexes.conf

Answer

inputs.conf

Answer

transforms.conf

Question 2

Which THREE of the following are true regarding license usage monitoring?

Accepted Answer

Usage can be viewed via the Splunk Web UI.. Monitoring can be done via the UI, the REST API, or by querying internal logs.

Answer

Usage must be calculated manually from event count.

Answer

License usage is only available to the splunk-system-user.

Question 3

You have a distributed environment. You need to ensure that specific knowledge objects (saved searches) created on a Search Head are available to all other Search Heads. What is the recommended way to handle this?

Accepted Answer

Use a Search Head Cluster and push the bundle via the deployer.. Splunk configurations should be managed via the Deployment Server or a Configuration Management tool like Git/Ansible to ensure consistency across search heads.

Answer

Manually copy the local/savedsearches.conf file to every server.

Answer

Enable indexer discovery on all search heads.

Answer

Restart the Splunk services on all search heads.

Question 4

Which TWO of the following are true about the 72-hour grace period?

Accepted Answer

It disables indexing after 72 hours.. The 72-hour grace period applies when a slave cannot reach the master; it is not a violation in the 30-day window sense.

Answer

It allows the admin to search during the period.

Answer

It only applies to trial licenses.

Answer

It counts as a license violation.

Question 5

Which THREE of the following items are considered 'license slaves'?

Accepted Answer

Standalone instances. Only indexers and search heads (that perform indexing) are typically categorized as slaves in this context; heavy forwarders are not.

Answer

Universal Forwarders

Answer

Deployment Servers

Question 6

Which of the following describes the purpose of a License Pool?

Accepted Answer

To distribute license quota among indexer groups.. License pools allow an administrator to allocate specific license quotas to different indexer groups.

Answer

To enable data replication across indexers.

Answer

To speed up data ingestion.

Answer

To increase the total license volume.

Question 7

You need to create a new user account and assign them to the 'power' role. Which interface provides the most direct way to do this?

Accepted Answer

Settings -> Access Controls -> Users. Settings -> Users provides the UI to create and modify user attributes and roles.

Answer

Settings -> Roles

Answer

Settings -> Server Settings

Answer

Settings -> Authentication Method

Question 8

Which TWO of the following are true about the Universal Forwarder?

Accepted Answer

It is designed to have a minimal resource footprint.. Universal forwarders perform no parsing and have a minimal footprint.

Answer

It can only forward data to one indexer at a time.

Answer

It requires a full Splunk Enterprise license.

Answer

It performs full data parsing and indexing.

Question 9

A Splunk administrator observes that the license master is reporting an 'indexer-slave' mismatch. Which configuration file should the admin check on the license slave?

Accepted Answer

server.conf. The slave's connection to the master is defined in the [license] stanza of server.conf.

Answer

outputs.conf

Answer

inputs.conf

Answer

indexes.conf

Question 10

What happens if the License Master becomes unreachable?

Accepted Answer

Indexing continues for 72 hours.. The indexers (slaves) will continue to index data for a grace period (typically 72 hours) before stopping.

Answer

Indexing continues indefinitely.

Answer

Indexing stops immediately.

Answer

Search heads stop working.

Question 11

Which TWO of the following are valid ways to monitor the status of a Splunk instance?

Accepted Answer

Running the 'splunk status' command.. Monitoring can be done via the CLI 'splunk status' or the Monitoring Console in the GUI.

Answer

Checking the /tmp directory for lock files.

Answer

Reading the indexer cluster's raw binary data.

Answer

Pinging the forwarder's local web port.

Question 12

Which TWO of the following actions occur when a Splunk license violation is active?

Accepted Answer

Splunk continues to index data.. During a violation, indexing continues, but the ability to perform searches is impacted according to the rules of the violation.

Answer

All user accounts are locked.

Answer

Data ingestion is blocked immediately.

Answer

The license key is automatically deleted.

Question 13

A user reports they cannot see data from a specific sourcetype after enabling a new input on the indexer. Which Splunk CLI command can you run on the indexer to verify if data is being ingested for that sourcetype?

Accepted Answer

splunk search "index=* sourcetype=your_type" | head 10. The 'splunk search' command allows you to verify data ingestion directly from the CLI.

Answer

splunk list inputs

Answer

splunk status

Answer

splunk show conf

Question 14

When configuring an indexer to receive data on port 9997, you notice that the Splunkd process is failing to bind to the port. What is the most likely cause?

Accepted Answer

Another process is already using the port.. Another process (or a previous instance of Splunk) is likely already holding that port open.

Answer

The indexer is not configured in the search head cluster.

Answer

The license is expired.

Answer

The indexer is missing a forwarder license.

Question 15

What happens to a local user account if the underlying LDAP group they belong to is deleted?

Accepted Answer

The user will be unable to authenticate via LDAP.. The local Splunk user object remains, but if authentication is tied exclusively to the LDAP group, the user will be unable to log in.

Answer

The user can still log in using their previous password.

Answer

The user account is automatically deleted from Splunk.

Answer

The user is automatically promoted to the 'admin' role.

Question 16

You need to enable multi-factor authentication (MFA) for your Splunk instance. Where is this usually integrated?

Accepted Answer

Via SAML integration with an Identity Provider.. MFA is typically integrated through the SAML Identity Provider, or via Duo Security integration if using the specific Splunk plugin.

Answer

In user-prefs.conf

Answer

Inside authorize.conf

Answer

By modifying the 'admin' user account in the CLI.

Question 17

What is the default role assigned to a new user account if no other role is specified?

Accepted Answer

user. The 'user' role is the default role assigned to new accounts.

Answer

admin

Answer

power

Answer

can_delete

Question 18

An administrator needs to ensure that users from an LDAP group 'Splunk_Power_Users' are automatically assigned the 'power' role in Splunk. Where is this mapping configured?

Accepted Answer

In authentication.conf within the [roleMap_LDAP_name] stanza.. LDAP group mapping is configured in the Authentication Method settings under 'Role mapping'.

Answer

In authorize.conf under the [role_power] stanza.

Answer

In user-prefs.conf.

Answer

In distsearch.conf.

Question 19

Which THREE of the following are true regarding the behavior of 'btool'?

Accepted Answer

It can check for configuration file syntax errors. btool is a utility for viewing, checking, and debugging configuration files.

Answer

It can modify configuration files directly

Answer

It can be used to restart the Splunk service

Question 20

Which Splunk component is responsible for orchestrating the transition of buckets from warm to cold?

Accepted Answer

Indexer. The Indexer process, specifically the bucket rolling process, handles the movement of buckets based on the index configuration.

Answer

License Master

Answer

Search Head

Answer

Deployment Server