SPLK-1003 Practice Exam 3 — 20 Questions

Question 1

What is the effect of setting 'allow_debug' to false in a role?

Accepted Answer

The user cannot use the debug tools in the search bar.. The 'allow_debug' setting in a role controls whether users with that role can access the debug tools (such as the 'Debug' option in the search bar that shows the search job inspector and other diagnostics). Setting it to false disables those debug features for the role. It does not affect login, export, or saving searches, which are governed by separate capabilities.

Answer

The user cannot log in.

Answer

The user cannot export data.

Answer

The user cannot save searches.

Question 2

Which TWO components are involved in managing Data Model acceleration?

Accepted Answer

Indexer. The indexers perform the work of building the acceleration, while the search head manages the acceleration configuration.

Answer

Deployment Server

Answer

License Master

Answer

Heavy Forwarder

Question 3

You are configuring a scripted input to run a python script. Where is the best location to store this script on a Universal Forwarder?

Accepted Answer

$SPLUNK_HOME/etc/apps/my_app/bin/. Scripts used by scripted inputs should be stored in an app's bin directory, such as $SPLUNK_HOME/etc/apps/my_app/bin/. This location is on Splunk's default PATH for scripted inputs, is included in app deployment bundles, and ensures the script is available wherever the app is deployed. Placing scripts here also keeps them versioned and portable across forwarders.

Answer

$SPLUNK_HOME/var/run/

Answer

/opt/scripts/

Answer

/tmp/

Question 4

What is the default port used by the Splunk Web interface?

Accepted Answer

8000. The Splunk Web interface (Splunk Web) listens on TCP port 8000 by default, which is where administrators and users access the browser-based UI for searching, dashboards, and administration. This is configured via the splunkweb stanza in web.conf (httpport setting). Port 8000 is distinct from the management port and the indexing/receiving port, making it the correct answer for browser-based access.

Answer

9997

Answer

8089

Answer

443

Question 5

When using the 'splunk cmd splunkd bucket-info' tool, what are you primarily investigating?

Accepted Answer

Bucket state and event boundaries.. The 'splunk cmd splunkd bucket-info' tool is used to inspect the state and event boundaries of buckets in a Splunk index. It provides details such as bucket ID, state (hot, warm, cold, frozen), time ranges (earliest and latest event timestamps), and event counts, which is essential for troubleshooting indexing, retention, and search issues. This makes 'bucket state and event boundaries' the correct answer.

Answer

Search performance metrics.

Answer

User authentication logs.

Answer

Indexer license usage.

Question 6

You have defined a setting in $SPLUNK_HOME/etc/system/local/inputs.conf and the same setting exists in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf. Which value takes precedence?

Accepted Answer

The app/local value. Splunk's configuration file precedence is determined by the directory location, not timestamps or alphabetical order. The order from lowest to highest precedence is: system/default, app/default, system/local, app/local. Since app/local has higher precedence than system/local, the setting in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf overrides the one in $SPLUNK_HOME/etc/system/local/inputs.conf.

Answer

The system/local value

Answer

The configuration with the most recent timestamp

Answer

The configuration alphabetically first

Question 7

When configuring 'LDAP Strategy', what is the purpose of the 'User Base DN'?

Accepted Answer

To define the root search path for users in LDAP.. The 'User Base DN' in an LDAP strategy specifies the distinguished name (DN) of the subtree in the LDAP directory where Splunk should search for user accounts. It acts as the root search path so Splunk knows where to begin looking when binding and authenticating users. Without a correct User Base DN, Splunk cannot locate user entries and authentication fails.

Answer

To define the authentication port.

Answer

To define the administrator's password.

Answer

To specify the LDAP server IP address.

Question 8

An administrator needs to change the default maximum size of an index. Which file should be modified?

Accepted Answer

indexes.conf. indexes.conf is the configuration file that defines index properties, including maxTotalDataSizeMB (the maximum size of an index) and frozenTimePeriodInSecs (retention). To change the default maximum size of an index, you modify the relevant index stanza in indexes.conf (typically in $SPLUNK_HOME/etc/system/local/ or an app). The setting maxTotalDataSizeMB controls the total disk footprint before the oldest buckets are frozen.

Answer

server.conf

Answer

props.conf

Answer

limits.conf

Question 9

Which Splunk GUI page provides a summary of all configured indexes and their current disk usage?

Accepted Answer

Settings > Data > Indexes. In Splunk, the 'Settings > Data > Indexes' page provides a summary of all configured indexes, including their current disk usage, size, and other details. This is the central location for managing indexes and monitoring their storage consumption.

Answer

Settings > Server Settings

Answer

Settings > Data > Inputs

Answer

Settings > Licensing

Question 10

When configuring a Deployment Client, what must be defined in deploymentclient.conf?

Accepted Answer

deploymentServer URI. The client must specify the URI and port of the Deployment Server.

Answer

The index location.

Answer

The list of indexers.

Answer

The password for the admin user.

Question 11

A Splunk administrator needs to reduce the storage footprint of an index named 'app_logs' on a standalone indexer. The index currently retains data indefinitely because no retention settings are configured. The administrator wants to (1) delete data older than 90 days and (2) cap the index at 500 GB, whichever limit is reached first. Which TWO settings should the administrator configure in indexes.conf to meet these requirements? (Choose two.)

Accepted Answer

maxTotalDataSizeMB = 512000. Meeting both a 90-day age limit and a 500 GB size cap requires two settings: frozenTimePeriodInSecs for age-based freezing and maxTotalDataSizeMB for size-based freezing. Splunk freezes buckets when either limit is reached, so the oldest data is removed first. Path-specific size limits and bucket roll size settings do not enforce total index size or age-based deletion.

Answer

coldPath.maxDataSizeMB = 512000

Answer

homePath.maxDataSizeMB = 512000

Answer

maxDataSize = 512000

Question 12

An administrator needs to monitor a local text file on a Windows server and send the data to a Splunk indexer. Which component is the most efficient choice for this task?

Accepted Answer

Universal Forwarder. The Universal Forwarder is designed for minimal resource consumption when collecting data and forwarding it to an indexer.

Answer

Deployment Server

Answer

Heavy Forwarder

Answer

Splunk Light

Question 13

You are troubleshooting a connection issue from a forwarder to an indexer. Which log file on the indexer would best show connection attempts from forwarders?

Accepted Answer

splunkd.log. splunkd.log on the indexer records connection attempts, handshakes, and errors from forwarders. It is the primary log for troubleshooting forwarder-to-indexer connectivity, including TCP connection issues, SSL negotiation, and authentication failures.

Answer

audit.log

Answer

web_service.log

Answer

metrics.log

Question 14

When using transforms.conf to extract fields, what is the 'SOURCE_KEY' setting used for?

Accepted Answer

To specify which field the regex is applied to. SOURCE_KEY allows you to specify a different field (or the whole raw event) to apply the regex to, instead of the default '_raw'.

Answer

To specify the index

Answer

To define the sourcetype

Answer

To set the time format

Question 15

If a user creates a configuration in their 'user' directory, how does it compare in precedence to the 'app' directory?

Accepted Answer

User precedence is higher. User-level configurations generally have the highest precedence, overriding app and system configurations.

Answer

Only system settings are higher

Answer

They are equal

Answer

App precedence is higher

Question 16

You have a Heavy Forwarder performing data routing. You need to send data to two different indexer clusters based on the sourcetype. How do you configure this?

Accepted Answer

Define multiple target groups in outputs.conf and use transforms.conf to route.. Data routing requires defining multiple target groups in outputs.conf and referencing them in transforms.conf.

Answer

Use inputs.conf to specify the destination indexer.

Answer

Configure the indexer to pull data from the forwarder.

Answer

Use a single outputs.conf with comma-separated values.

Question 17

How does Splunk handle configuration files that are missing a required attribute?

Accepted Answer

The engine ignores the attribute and uses defaults. When a Splunk configuration file is missing a required attribute, the engine does not fail or discard the file — it falls back to the default value defined in the underlying spec file (e.g., $SPLUNK_HOME/etc/system/README/*.conf.spec). This allows Splunk to remain resilient to incomplete configurations. The attribute is effectively ignored and the default is applied.

Answer

The Splunk service fails to start

Answer

The file is marked as corrupted

Answer

The entire file is ignored

Question 18

What command is used to check the health and integrity of an index bucket?

Accepted Answer

splunk fsck. The 'splunk fsck' command is used to check the health and integrity of index buckets. It can detect and repair inconsistencies in bucket metadata and index files, ensuring that the index is not corrupted.

Answer

splunk status

Answer

splunk check

Answer

splunk validate

Question 19

What is the primary function of the 'Indexer Cluster' feature?

Accepted Answer

To provide data replication and high availability.. Indexer clustering provides data replication and high availability by grouping indexers into a cluster with a replication factor and search factor. If a peer node fails, replicated buckets on other peers keep the data searchable, and the cluster master coordinates bucket fixup to restore the target replication/search factors. This is the primary purpose of the feature — resilience, not performance.

Answer

To increase the web interface speed.

Answer

To speed up search queries across multiple head nodes.

Answer

To manage user permissions for index access.

Question 20

What happens to a user's session if their role is modified while they are logged in?

Accepted Answer

The user must log out and back in for changes to take effect.. In Splunk, role and permission changes are not dynamically applied to an already-authenticated session. The user's session retains the permissions and role assignments that were in effect at the time of login, so the user must log out and log back in for the modified role to take effect. This is because Splunk caches role information in the session token at authentication time.

Answer

The changes are applied immediately to their current session.

Answer

The user's session is terminated after 5 minutes.

Answer

The user is forced to log out immediately.