SPLK-1003 Practice Test 4 — 25 Questions

Question 1

A Splunk administrator needs to identify how much data is being indexed across multiple indexers to ensure they do not exceed their daily license quota. Where should the admin look first?

Accepted Answer

Settings > Licensing. The License Master view provides the centralized dashboard for daily license usage reporting.

Answer

Settings > Distributed Search

Answer

Settings > Indexer Clustering

Answer

Settings > Forwarder Management

Question 2

An administrator wants to see a daily breakdown of license usage for the last 30 days. Which view is most appropriate?

Accepted Answer

Settings > Licensing > Usage Report. The 'Usage Report' within the Licensing section of Splunk Web provides this historical visualization.

Answer

Settings > Indexer Clustering

Answer

Settings > Licensing > Master

Answer

Settings > Forwarder Management

Question 3

If you want to prevent a user from using the 'delete' command, which capability must be removed from their assigned role?

Accepted Answer

delete. The 'delete' capability is required to run the 'delete' search command.

Answer

edit_search

Answer

can_delete_data

Answer

admin_all_objects

Question 4

Which TWO settings in indexes.conf are used to control the rotation of hot buckets?

Accepted Answer

maxHotSpanSecs. maxDataSize and maxHotSpanSecs are the two primary parameters that determine when a bucket should roll from hot to warm.

Answer

frozenTimePeriodInSecs

Answer

maxTotalDataSizeMB

Answer

coldPath

Question 5

Which TWO methods can be used to monitor the disk usage of an index?

Accepted Answer

Settings > Data > Indexes page.. The Splunk GUI provides a dashboard and the CLI provides 'splunk list indexes' to view status.

Answer

Running a search on _audit.

Answer

Viewing the license_usage.log.

Answer

Checking the web.conf file.

Question 6

Which command is used to restart the Splunk service after modifying configuration files?

Accepted Answer

splunk restart. 'splunk restart' is the standard command to apply configuration changes by restarting the service.

Answer

splunk stop-start

Answer

splunk refresh

Answer

splunk reload

Question 7

Which THREE of the following represent true statements about the 'transforms.conf' file?

Accepted Answer

It is used to perform data masking or anonymization. transforms.conf is used for complex extractions, routing, and anonymization.

Answer

It is the primary file for setting up TCP inputs

Answer

It is used to define the sourcetype of data

Question 8

If you need to change the logging level of a specific component on a Universal Forwarder, which file should you edit?

Accepted Answer

log-local.cfg. log-local.cfg (or log.cfg) controls the granularity of internal Splunk logging.

Answer

server.conf

Answer

outputs.conf

Answer

inputs.conf

Question 9

An administrator needs to move the License Master from one server to another. What is the most critical step?

Accepted Answer

Updating the Master URI on all license slaves.. Moving the license master requires transferring the license keys and re-pointing all slaves to the new master URI.

Answer

Reinstalling Splunk on all indexers.

Answer

Changing the license key files on the indexers.

Answer

Deleting the indexer clusters.

Question 10

Which TWO of the following are valid ways to resolve a license violation?

Accepted Answer

Add a new license key with higher capacity.. A violation can be resolved by increasing the quota via a new key or reducing the data ingestion volume.

Answer

Delete the license pool.

Answer

Restart the license master.

Answer

Reinstall Splunk on the indexers.

Question 11

An administrator needs to change the default maximum size of an index. Which file should be modified?

Accepted Answer

indexes.conf. indexes.conf is the authoritative file for index settings including 'maxTotalDataSizeMB'.

Answer

server.conf

Answer

props.conf

Answer

limits.conf

Question 12

Which TWO of the following are true regarding the Deployment Server?

Accepted Answer

It manages configurations for deployment clients.. The DS distributes apps to deployment clients and keeps them in sync.

Answer

It can only manage forwarders on the same subnet.

Answer

It is a required component for all Splunk deployments.

Answer

It is responsible for indexing raw logs.

Question 13

Which stanza is required in props.conf to identify a sourcetype?

Accepted Answer

[sourcetype]. The sourcetype stanza is defined by the name enclosed in brackets, e.g., [my_sourcetype].

Answer

[default]

Answer

sourcetype = name

Answer

[source::name]

Question 14

What is the primary function of the Deployment Server?

Accepted Answer

Centralized management of configuration files. The Deployment Server acts as a central repository for managing configurations and apps across forwarders.

Answer

Indexing data

Answer

Parsing data

Answer

Performing searches

Question 15

You are troubleshooting a parsing issue where multiline events are not being grouped correctly. Where in the configuration files would you adjust the 'BREAK_ONLY_BEFORE' setting?

Accepted Answer

props.conf. This setting is defined in props.conf under the specific sourcetype stanza.

Answer

outputs.conf

Answer

inputs.conf

Answer

indexes.conf

Question 16

You need to restrict a specific user role from searching a particular index. Where is this configuration defined?

Accepted Answer

authorize.conf. Role-based access control (RBAC) allows you to restrict indexed data access via the 'srchIndexesAllowed' setting in authorize.conf.

Answer

user-prefs.conf

Answer

indexes.conf

Answer

authentication.conf

Question 17

What is the primary function of the 'Indexer Cluster' feature?

Accepted Answer

To provide data replication and high availability.. Indexer Clustering provides data high availability and replication across multiple indexers.

Answer

To increase the web interface speed.

Answer

To speed up search queries across multiple head nodes.

Answer

To manage user permissions for index access.

Question 18

Which file is responsible for defining how data is rotated in an index?

Accepted Answer

indexes.conf. indexes.conf contains settings like maxDataSize and maxHotSpanSecs which define data rotation.

Answer

inputs.conf

Answer

props.conf

Answer

server.conf

Question 19

Which TWO directories are part of the standard Splunk configuration file precedence hierarchy?

Accepted Answer

$SPLUNK_HOME/etc/apps/app_name/default. System and App directories are core parts of the configuration hierarchy.

Answer

$SPLUNK_HOME/var/run

Answer

$SPLUNK_HOME/etc/licenses

Answer

$SPLUNK_HOME/etc/users/admin

Question 20

To monitor a network port using a Universal Forwarder, which stanza should be added to inputs.conf?

Accepted Answer

[tcp://9997]. TCP and UDP inputs require the [tcp://] or [udp://] stanza in inputs.conf.

Answer

[script://./bin/my.py]

Answer

[monitor:///var/log/]

Answer

[winhost://]