SPLK-1003 Practice Test 2 — 30 Questions

Question 1

If you want to prevent a user from using the 'delete' command, which capability must be removed from their assigned role?

Accepted Answer

delete. In Splunk, the 'delete' command is controlled by the 'delete' capability. This capability allows a user to use the delete command to remove events from indexes. To prevent a user from using the delete command, you must remove the 'delete' capability from their role. Other capabilities like edit_search, can_delete_data, and admin_all_objects do not directly govern the delete command.

Answer

edit_search

Answer

can_delete_data

Answer

admin_all_objects

Question 2

A Splunk administrator needs to add a new index named `audit_logs` that will store data on a specific storage volume defined as `volume:audit_vol`. The volume has a maximum size of 500 GB. Which configuration in `indexes.conf` is required to associate the index with this volume?

Accepted Answer

Set `homePath = volume:audit_vol/audit_logs/db` and `coldPath = volume:audit_vol/audit_logs/colddb`.. To associate an index with a storage volume, the `homePath` and `coldPath` must use the `volume:<name>` syntax. This ensures all buckets for the index are stored within the volume, and the volume's `maxVolumeDataSizeMB` setting applies. The volume itself must be defined in a separate `volume` stanza with its path and size limit.

Answer

Set `volume = audit_vol` in the index stanza.

Answer

Set `homePath = /opt/splunk/var/lib/splunk/audit_logs/db` and `coldPath = volume:audit_vol/audit_logs/colddb`.

Answer

Set `homePath = volume:audit_vol/audit_logs/db` and `coldPath = volume:audit_vol/audit_logs/colddb`, and also set `maxVolumeDataSizeMB = 500000` in the index stanza.

Question 3

A Splunk administrator is configuring a Universal Forwarder to monitor a network share on a Windows file server. The forwarder is installed on a separate Windows server and runs under the Local System account. The network share requires domain authentication. The administrator wants to ensure that the forwarder can read the files on the share. What should the administrator do?

Accepted Answer

Configure the Universal Forwarder service to log on as a domain user with read access to the share.. The Universal Forwarder service runs as Local System by default, which lacks domain credentials to access remote network shares. To read files from a network share that requires domain authentication, the service must run under a domain user account that has read permissions on the share. This is done by changing the service logon account in Windows Services. Other methods like adding Local System to share permissions or using proxy settings in inputs.conf are not valid.

Answer

Configure the forwarder to use a proxy account by setting 'proxyUser' and 'proxyPassword' in inputs.conf.

Answer

Enable 'useSSL = true' in outputs.conf to allow secure authentication to the share.

Answer

Add the Local System account to the share's permissions with read access.

Question 4

An administrator manages a Splunk Enterprise deployment where a critical index named 'audit_logs' must retain searchable data for 90 days. Compliance requires that after 90 days, the data must be moved to a remote NFS share for archival, but it must not be searchable in Splunk. The administrator has set frozenTimePeriodInSecs = 7776000 in indexes.conf for this index. Which additional configuration is required to ensure that buckets are archived to the remote NFS share instead of being deleted?

Accepted Answer

Set coldToFrozenDir to the NFS mount path in the index stanza.. To archive frozen buckets to a remote location, Splunk provides the coldToFrozenDir setting in indexes.conf. When a bucket reaches the frozen state, Splunk moves it to the specified directory instead of deleting it. This makes the data non-searchable but preserves it for compliance. The other options either reference invalid settings or misunderstand the bucket lifecycle.

Answer

Set coldPath to the NFS mount path and increase maxHotSpanSecs.

Answer

Set frozenTimePeriodInSecs to a higher value and configure a scripted input to copy buckets.

Answer

Set archiveOnDelete to true in the index stanza and specify a remote path.

Question 5

Which TWO of the following are true about the Universal Forwarder?

Accepted Answer

It is designed to have a minimal resource footprint.. Option A is correct because the Universal Forwarder is a lightweight agent purpose-built to consume minimal CPU, memory, and disk resources on the source host, using a small binary with no bundled search or indexing components. Option D is correct because the Universal Forwarder does not parse or index data; it only collects, optionally compresses/encrypts, and forwards raw data (typically via TCP 9997) to a receiving indexer or heavy forwarder, where parsing and indexing occur. Option B is wrong because a Universal Forwarder can be configured with multiple outputs to send data to several indexers simultaneously, including via load balancing or an indexer cluster. Option C is wrong because the Universal Forwarder is free to download and use and does not require a Splunk Enterprise license; only the indexing/receiving side needs licensing. Option E is wrong because full parsing and indexing are performed by indexers (or heavy forwarders), not by the Universal Forwarder, which by design leaves data unparsed.

Answer

It can only forward data to one indexer at a time.

Answer

It requires a full Splunk Enterprise license.

Answer

It performs full data parsing and indexing.

Question 6

You are configuring a Universal Forwarder to send logs to an Indexer Cluster. Where should you define the outputs.conf file to ensure the forwarder correctly balances traffic across all indexers?

Accepted Answer

$SPLUNK_HOME/etc/system/local/. For a Universal Forwarder, outputs.conf should be placed in $SPLUNK_HOME/etc/system/local/ because that directory holds machine-specific, administrator-created configurations that override defaults and are not tied to a particular app. This ensures the forwarder's output routing (including indexer discovery/load balancing) is applied globally.

Answer

$SPLUNK_HOME/etc/system/default/

Answer

$SPLUNK_HOME/etc/manager/local/

Answer

$SPLUNK_HOME/etc/apps/search/local/

Question 7

What is the purpose of the 'srchFilter' attribute in a role definition?

Accepted Answer

To automatically prepend a filter to all searches performed by the user.. The 'srchFilter' attribute in a role definition automatically prepends a filter to all searches performed by users with that role. This is used to enforce row-level security, such as restricting results to a specific index, sourcetype, or field value. For example, setting srchFilter = host=web* ensures users only see events from web hosts. It does not restrict index visibility (that's done via index permissions) or limit result counts.

Answer

To restrict which indexes a user can see.

Answer

To block specific users from the system.

Answer

To limit the number of results returned.

Question 8

Why might an administrator need to use the 'splunk edit licenser-localslave' command?

Accepted Answer

To configure the local instance to be a license slave.. The 'splunk edit licenser-localslave' command is used to configure a Splunk instance to act as a license slave (now called a license peer) that reports to a license master (license manager). It sets the license master URI on the local instance so it participates in the centralized licensing pool. This is the standard CLI method for pointing an instance at a license manager.

Answer

To reset the license violation counter.

Answer

To create a new license pool.

Answer

To delete an expired license.

Question 9

In props.conf, what does the 'REPORT-' prefix signify?

Accepted Answer

It defines a search-time extraction. In props.conf, the `REPORT-` prefix defines a search-time field extraction that references a transform stanza (typically in transforms.conf) using a regex. It is applied when a search runs against the data, not when the data is indexed. This is why REPORT- extractions can be added or modified without re-indexing existing events.

Answer

It triggers an alert

Answer

It defines an index-time extraction

Answer

It defines a line-breaking rule

Question 10

You need to enable multi-factor authentication (MFA) for your Splunk instance. Where is this usually integrated?

Accepted Answer

Via SAML integration with an Identity Provider.. Splunk does not natively implement MFA; instead, it delegates authentication to an external Identity Provider (IdP) via SAML. When SAML is configured, Splunk acts as a Service Provider (SP), and the IdP handles the actual authentication, including MFA enforcement. This is the standard and recommended approach for enabling MFA in Splunk.

Answer

In user-prefs.conf

Answer

Inside authorize.conf

Answer

By modifying the 'admin' user account in the CLI.

Question 11

What is the effect of setting 'allow_debug' to false in a role?

Accepted Answer

The user cannot use the debug tools in the search bar.. The 'allow_debug' setting in a role controls whether users with that role can access the debug tools (such as the 'Debug' option in the search bar that shows the search job inspector and other diagnostics). Setting it to false disables those debug features for the role. It does not affect login, export, or saving searches, which are governed by separate capabilities.

Answer

The user cannot log in.

Answer

The user cannot export data.

Answer

The user cannot save searches.

Question 12

Which TWO components are involved in managing Data Model acceleration?

Accepted Answer

Indexer. The indexers perform the work of building the acceleration, while the search head manages the acceleration configuration.

Answer

Deployment Server

Answer

License Master

Answer

Heavy Forwarder

Question 13

You are configuring a scripted input to run a python script. Where is the best location to store this script on a Universal Forwarder?

Accepted Answer

$SPLUNK_HOME/etc/apps/my_app/bin/. Scripts used by scripted inputs should be stored in an app's bin directory, such as $SPLUNK_HOME/etc/apps/my_app/bin/. This location is on Splunk's default PATH for scripted inputs, is included in app deployment bundles, and ensures the script is available wherever the app is deployed. Placing scripts here also keeps them versioned and portable across forwarders.

Answer

$SPLUNK_HOME/var/run/

Answer

/opt/scripts/

Answer

/tmp/

Question 14

What is the default port used by the Splunk Web interface?

Accepted Answer

8000. The Splunk Web interface (Splunk Web) listens on TCP port 8000 by default, which is where administrators and users access the browser-based UI for searching, dashboards, and administration. This is configured via the splunkweb stanza in web.conf (httpport setting). Port 8000 is distinct from the management port and the indexing/receiving port, making it the correct answer for browser-based access.

Answer

9997

Answer

8089

Answer

443

Question 15

When using the 'splunk cmd splunkd bucket-info' tool, what are you primarily investigating?

Accepted Answer

Bucket state and event boundaries.. The 'splunk cmd splunkd bucket-info' tool is used to inspect the state and event boundaries of buckets in a Splunk index. It provides details such as bucket ID, state (hot, warm, cold, frozen), time ranges (earliest and latest event timestamps), and event counts, which is essential for troubleshooting indexing, retention, and search issues. This makes 'bucket state and event boundaries' the correct answer.

Answer

Search performance metrics.

Answer

User authentication logs.

Answer

Indexer license usage.

Question 16

You have defined a setting in $SPLUNK_HOME/etc/system/local/inputs.conf and the same setting exists in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf. Which value takes precedence?

Accepted Answer

The app/local value. Splunk's configuration file precedence is determined by the directory location, not timestamps or alphabetical order. The order from lowest to highest precedence is: system/default, app/default, system/local, app/local. Since app/local has higher precedence than system/local, the setting in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf overrides the one in $SPLUNK_HOME/etc/system/local/inputs.conf.

Answer

The system/local value

Answer

The configuration with the most recent timestamp

Answer

The configuration alphabetically first

Question 17

When configuring 'LDAP Strategy', what is the purpose of the 'User Base DN'?

Accepted Answer

To define the root search path for users in LDAP.. The 'User Base DN' in an LDAP strategy specifies the distinguished name (DN) of the subtree in the LDAP directory where Splunk should search for user accounts. It acts as the root search path so Splunk knows where to begin looking when binding and authenticating users. Without a correct User Base DN, Splunk cannot locate user entries and authentication fails.

Answer

To define the authentication port.

Answer

To define the administrator's password.

Answer

To specify the LDAP server IP address.

Question 18

An administrator needs to change the default maximum size of an index. Which file should be modified?

Accepted Answer

indexes.conf. indexes.conf is the configuration file that defines index properties, including maxTotalDataSizeMB (the maximum size of an index) and frozenTimePeriodInSecs (retention). To change the default maximum size of an index, you modify the relevant index stanza in indexes.conf (typically in $SPLUNK_HOME/etc/system/local/ or an app). The setting maxTotalDataSizeMB controls the total disk footprint before the oldest buckets are frozen.

Answer

server.conf

Answer

props.conf

Answer

limits.conf

Question 19

Which Splunk GUI page provides a summary of all configured indexes and their current disk usage?

Accepted Answer

Settings > Data > Indexes. In Splunk, the 'Settings > Data > Indexes' page provides a summary of all configured indexes, including their current disk usage, size, and other details. This is the central location for managing indexes and monitoring their storage consumption.

Answer

Settings > Server Settings

Answer

Settings > Data > Inputs

Answer

Settings > Licensing

Question 20

When configuring a Deployment Client, what must be defined in deploymentclient.conf?

Accepted Answer

deploymentServer URI. The client must specify the URI and port of the Deployment Server.

Answer

The index location.

Answer

The list of indexers.

Answer

The password for the admin user.