SPLK-1003 Practice Test 7 — 10 Questions

Question 1

You have a Heavy Forwarder performing data routing. You need to send data to two different indexer clusters based on the sourcetype. How do you configure this?

Accepted Answer

Define multiple target groups in outputs.conf and use transforms.conf to route.. Data routing requires defining multiple target groups in outputs.conf and referencing them in transforms.conf.

Answer

Use inputs.conf to specify the destination indexer.

Answer

Configure the indexer to pull data from the forwarder.

Answer

Use a single outputs.conf with comma-separated values.

Question 2

Which capability is exclusive to a Heavy Forwarder compared to a Universal Forwarder?

Accepted Answer

Parsing data. Heavy Forwarders can perform full parsing, indexing, and routing of data.

Answer

Collecting local files

Answer

Connecting to a Deployment Server

Answer

Forwarding data

Question 3

How does Splunk handle configuration files that are missing a required attribute?

Accepted Answer

The engine ignores the attribute and uses defaults. Splunk generally uses default values if an attribute is omitted, provided the stanza itself is valid.

Answer

The Splunk service fails to start

Answer

The file is marked as corrupted

Answer

The entire file is ignored

Question 4

Which THREE configuration files are most critical for defining how data is ingested and parsed?

Accepted Answer

transforms.conf. inputs.conf, props.conf, and transforms.conf form the core of data processing.

Answer

server.conf

Answer

indexes.conf

Question 5

Why might an administrator need to use the 'splunk edit licenser-localslave' command?

Accepted Answer

To configure the local instance to be a license slave.. This command allows the local instance to be configured as a license slave if it wasn't during installation.

Answer

To reset the license violation counter.

Answer

To create a new license pool.

Answer

To delete an expired license.

Question 6

What is the maximum number of license violations allowed in a 30-day period before search is blocked?

Accepted Answer

5. Splunk allows 5 violations in a 30-day rolling window before blocking search.

Answer

3

Answer

10

Answer

1

Question 7

What is the default port used by the Splunk Web interface?

Accepted Answer

8000. 8000 is the standard default port for Splunk Web.

Answer

9997

Answer

8089

Answer

443

Question 8

What happens to a user's session if their role is modified while they are logged in?

Accepted Answer

The user must log out and back in for changes to take effect.. Changes to a user's role permissions take effect only upon the next login (or session refresh).

Answer

The changes are applied immediately to their current session.

Answer

The user's session is terminated after 5 minutes.

Answer

The user is forced to log out immediately.

Question 9

If you want to use SAML authentication, which component must be configured as the 'Service Provider'?

Accepted Answer

The Splunk Instance.. The Splunk instance itself acts as the Service Provider (SP) in the SAML handshake.

Answer

The browser.

Answer

The Identity Provider (IdP).

Answer

The LDAP Server.

Question 10

When using the 'splunk cmd splunkd bucket-info' tool, what are you primarily investigating?

Accepted Answer

Bucket state and event boundaries.. This tool allows administrators to inspect the properties of individual buckets, such as size, state, and event counts.

Answer

Search performance metrics.

Answer

User authentication logs.

Answer

Indexer license usage.