SPLK-1003 Practice Test 4 — 10 Questions

Question 1

Which TWO of the following are valid ways to monitor the status of a Splunk instance?

Accepted Answer

Running the 'splunk status' command.. Monitoring can be done via the CLI 'splunk status' or the Monitoring Console in the GUI.

Answer

Checking the /tmp directory for lock files.

Answer

Reading the indexer cluster's raw binary data.

Answer

Pinging the forwarder's local web port.

Question 2

Which TWO of the following actions occur when a Splunk license violation is active?

Accepted Answer

Splunk continues to index data.. During a violation, indexing continues, but the ability to perform searches is impacted according to the rules of the violation.

Answer

All user accounts are locked.

Answer

Data ingestion is blocked immediately.

Answer

The license key is automatically deleted.

Question 3

A user reports they cannot see data from a specific sourcetype after enabling a new input on the indexer. Which Splunk CLI command can you run on the indexer to verify if data is being ingested for that sourcetype?

Accepted Answer

splunk search "index=* sourcetype=your_type" | head 10. The 'splunk search' command allows you to verify data ingestion directly from the CLI.

Answer

splunk list inputs

Answer

splunk status

Answer

splunk show conf

Question 4

When configuring an indexer to receive data on port 9997, you notice that the Splunkd process is failing to bind to the port. What is the most likely cause?

Accepted Answer

Another process is already using the port.. Another process (or a previous instance of Splunk) is likely already holding that port open.

Answer

The indexer is not configured in the search head cluster.

Answer

The license is expired.

Answer

The indexer is missing a forwarder license.

Question 5

What happens to a local user account if the underlying LDAP group they belong to is deleted?

Accepted Answer

The user will be unable to authenticate via LDAP.. The local Splunk user object remains, but if authentication is tied exclusively to the LDAP group, the user will be unable to log in.

Answer

The user can still log in using their previous password.

Answer

The user account is automatically deleted from Splunk.

Answer

The user is automatically promoted to the 'admin' role.

Question 6

You need to enable multi-factor authentication (MFA) for your Splunk instance. Where is this usually integrated?

Accepted Answer

Via SAML integration with an Identity Provider.. MFA is typically integrated through the SAML Identity Provider, or via Duo Security integration if using the specific Splunk plugin.

Answer

In user-prefs.conf

Answer

Inside authorize.conf

Answer

By modifying the 'admin' user account in the CLI.

Question 7

What is the default role assigned to a new user account if no other role is specified?

Accepted Answer

user. The 'user' role is the default role assigned to new accounts.

Answer

admin

Answer

power

Answer

can_delete

Question 8

An administrator needs to ensure that users from an LDAP group 'Splunk_Power_Users' are automatically assigned the 'power' role in Splunk. Where is this mapping configured?

Accepted Answer

In authentication.conf within the [roleMap_LDAP_name] stanza.. LDAP group mapping is configured in the Authentication Method settings under 'Role mapping'.

Answer

In authorize.conf under the [role_power] stanza.

Answer

In user-prefs.conf.

Answer

In distsearch.conf.

Question 9

Which THREE of the following are true regarding the behavior of 'btool'?

Accepted Answer

It can check for configuration file syntax errors. btool is a utility for viewing, checking, and debugging configuration files.

Answer

It can modify configuration files directly

Answer

It can be used to restart the Splunk service

Question 10

Which Splunk component is responsible for orchestrating the transition of buckets from warm to cold?

Accepted Answer

Indexer. The Indexer process, specifically the bucket rolling process, handles the movement of buckets based on the index configuration.

Answer

License Master

Answer

Search Head

Answer

Deployment Server