SPLK-1003 Practice Test 2 — 30 Questions

Question 1

Which TWO of the following are valid ways to monitor the status of a Splunk instance?

Accepted Answer

Running the 'splunk status' command.. Monitoring can be done via the CLI 'splunk status' or the Monitoring Console in the GUI.

Answer

Checking the /tmp directory for lock files.

Answer

Reading the indexer cluster's raw binary data.

Answer

Pinging the forwarder's local web port.

Question 2

Which TWO of the following actions occur when a Splunk license violation is active?

Accepted Answer

Splunk continues to index data.. During a violation, indexing continues, but the ability to perform searches is impacted according to the rules of the violation.

Answer

All user accounts are locked.

Answer

Data ingestion is blocked immediately.

Answer

The license key is automatically deleted.

Question 3

A user reports they cannot see data from a specific sourcetype after enabling a new input on the indexer. Which Splunk CLI command can you run on the indexer to verify if data is being ingested for that sourcetype?

Accepted Answer

splunk search "index=* sourcetype=your_type" | head 10. The 'splunk search' command allows you to verify data ingestion directly from the CLI.

Answer

splunk list inputs

Answer

splunk status

Answer

splunk show conf

Question 4

When configuring an indexer to receive data on port 9997, you notice that the Splunkd process is failing to bind to the port. What is the most likely cause?

Accepted Answer

Another process is already using the port.. Another process (or a previous instance of Splunk) is likely already holding that port open.

Answer

The indexer is not configured in the search head cluster.

Answer

The license is expired.

Answer

The indexer is missing a forwarder license.

Question 5

What happens to a local user account if the underlying LDAP group they belong to is deleted?

Accepted Answer

The user will be unable to authenticate via LDAP.. The local Splunk user object remains, but if authentication is tied exclusively to the LDAP group, the user will be unable to log in.

Answer

The user can still log in using their previous password.

Answer

The user account is automatically deleted from Splunk.

Answer

The user is automatically promoted to the 'admin' role.

Question 6

You need to enable multi-factor authentication (MFA) for your Splunk instance. Where is this usually integrated?

Accepted Answer

Via SAML integration with an Identity Provider.. MFA is typically integrated through the SAML Identity Provider, or via Duo Security integration if using the specific Splunk plugin.

Answer

In user-prefs.conf

Answer

Inside authorize.conf

Answer

By modifying the 'admin' user account in the CLI.

Question 7

What is the default role assigned to a new user account if no other role is specified?

Accepted Answer

user. The 'user' role is the default role assigned to new accounts.

Answer

admin

Answer

power

Answer

can_delete

Question 8

An administrator needs to ensure that users from an LDAP group 'Splunk_Power_Users' are automatically assigned the 'power' role in Splunk. Where is this mapping configured?

Accepted Answer

In authentication.conf within the [roleMap_LDAP_name] stanza.. LDAP group mapping is configured in the Authentication Method settings under 'Role mapping'.

Answer

In authorize.conf under the [role_power] stanza.

Answer

In user-prefs.conf.

Answer

In distsearch.conf.

Question 9

Which THREE of the following are true regarding the behavior of 'btool'?

Accepted Answer

It can check for configuration file syntax errors. btool is a utility for viewing, checking, and debugging configuration files.

Answer

It can modify configuration files directly

Answer

It can be used to restart the Splunk service

Question 10

Which Splunk component is responsible for orchestrating the transition of buckets from warm to cold?

Accepted Answer

Indexer. The Indexer process, specifically the bucket rolling process, handles the movement of buckets based on the index configuration.

Answer

License Master

Answer

Search Head

Answer

Deployment Server

Question 11

An administrator has configured a License Pool and assigned specific indexers to it. However, the indexers are still consuming from the 'default' pool. What is the most likely cause?

Accepted Answer

The license_pool attribute in server.conf was not mapped correctly to the License Master.. The license pool configuration requires the indexers to be explicitly configured to point to the License Master, and the License Master must be aware of the specific pool assignment for those slaves.

Answer

License pools only apply to search heads.

Answer

The indexers have not been restarted.

Answer

The indexers are using a trial license.

Question 12

An administrator needs to monitor a local text file on a Windows server and send the data to a Splunk indexer. Which component is the most efficient choice for this task?

Accepted Answer

Universal Forwarder. The Universal Forwarder is designed for minimal resource consumption when collecting data and forwarding it to an indexer.

Answer

Deployment Server

Answer

Heavy Forwarder

Answer

Splunk Light

Question 13

Which file would you edit to change the TCP listening port for a Splunk Universal Forwarder?

Accepted Answer

inputs.conf. inputs.conf is the standard file for configuring data inputs like TCP ports.

Answer

outputs.conf

Answer

props.conf

Answer

server.conf

Question 14

A user reports that a setting in props.conf is not being applied. You want to see the final merged configuration for a specific sourcetype on a specific host. Which tool should you use?

Accepted Answer

splunk cmd btool props list --debug. splunk btool is the standard CLI utility to show the merged configuration files for a specific context.

Answer

splunk show-config

Answer

splunk edit props

Answer

splunk list configs

Question 15

When using transforms.conf to extract fields, what is the 'SOURCE_KEY' setting used for?

Accepted Answer

To specify which field the regex is applied to. SOURCE_KEY allows you to specify a different field (or the whole raw event) to apply the regex to, instead of the default '_raw'.

Answer

To specify the index

Answer

To define the sourcetype

Answer

To set the time format

Question 16

When configuring a Deployment Client, what must be defined in deploymentclient.conf?

Accepted Answer

deploymentServer URI. The client must specify the URI and port of the Deployment Server.

Answer

The index location.

Answer

The list of indexers.

Answer

The password for the admin user.

Question 17

You have configured a serverclass in serverclass.conf on the Deployment Server. Which action is required to ensure that the forwarders receive the new configuration?

Accepted Answer

Run the reload deploy-server command. After updating configuration files on the Deployment Server, you must either wait for the poll interval or trigger a reload of the deployment server configuration.

Answer

...

Answer

Update outputs.conf on the client

Answer

Restart the forwarder service

Answer

Modify the indexer's inputs.conf

Question 18

You need to modify the default behavior of a Splunk application without editing the files inside the 'default' directory. Where should you create the override file?

Accepted Answer

$SPLUNK_HOME/etc/apps/app_name/local/. Best practices dictate that configurations should be overridden in the 'local' directory to prevent loss during updates.

Answer

$SPLUNK_HOME/etc/system/default/

Answer

$SPLUNK_HOME/etc/users/admin/

Answer

$SPLUNK_HOME/etc/apps/app_name/default/

Question 19

What is the purpose of the 'TIME_PREFIX' attribute in props.conf?

Accepted Answer

To specify the start of the timestamp. It specifies the regex pattern to locate the start of the timestamp in an event.

Answer

To set the time format

Answer

To define the timezone

Answer

To truncate the timestamp

Question 20

You are deploying a Universal Forwarder to a Windows server that must monitor local Event Logs and send them to an Indexer. Which component is required to handle the parsing of these logs before they are forwarded?

Accepted Answer

The Indexer. Universal Forwarders do not perform heavy parsing. They forward data as-is, and the Indexer handles the parsing.

Answer

The Deployment Server

Answer

An intermediate UF

Answer

A Heavy Forwarder