CCNA Configuration Files Questions

Multi-Selecthard

Which THREE of the following are true regarding the configuration precedence of apps?

Select 3 answers

A.You can use app.conf to control the precedence of apps

B.App local directory overrides app default directory

C.User settings are less important than app settings

D.System default settings are overridden by app settings

E.App precedence is defined by the directory order in etc/apps

AnswersA, B, D

The 'priority' setting in app.conf can influence app loading order.

Why this answer

App precedence is determined by the order in which they are loaded, which can be controlled in app.conf, and they override the system default.

Practice this question →

MCQhard

If a user creates a configuration in their 'user' directory, how does it compare in precedence to the 'app' directory?

A.Only system settings are higher

B.User precedence is higher

C.They are equal

D.App precedence is higher

AnswerB

The user-level local directory has the highest precedence.

Why this answer

User-level configurations generally have the highest precedence, overriding app and system configurations.

Practice this question →

MCQmedium

You need to modify the default behavior of a Splunk application without editing the files inside the 'default' directory. Where should you create the override file?

A.$SPLUNK_HOME/etc/system/default/

B.$SPLUNK_HOME/etc/apps/app_name/local/

C.$SPLUNK_HOME/etc/users/admin/

D.$SPLUNK_HOME/etc/apps/app_name/default/

AnswerB

The local directory is specifically designed for configuration overrides.

Why this answer

Best practices dictate that configurations should be overridden in the 'local' directory to prevent loss during updates.

Practice this question →

MCQmedium

You need to ensure that specific data is sent to a specific indexer using the outputs.conf file. Which stanza is used for this?

A.[tcpout]

B.[index]

C.[forwarder]

D.[indexer]

AnswerA

[tcpout] is the stanza for configuring forwarding.

Why this answer

The [tcpout] stanza is used in outputs.conf to define forwarding destinations.

Practice this question →

MCQmedium

You are troubleshooting a parsing issue. You want to see the configuration file path that contributed a specific setting. What flag should you use with btool?

A.--show-files

B.--list-files

C.--debug

D.--source

AnswerA

This flag displays the source file for each configuration line.

Why this answer

The --show-files flag lists the file path for each setting returned by btool.

Practice this question →

Multi-Selectmedium

Which TWO of the following are valid stanza types found in indexes.conf?

Select 2 answers

A.[tcpout]

B.[default]

C.[input]

D.[source::...]

E.[index_name]

AnswersB, E

Defines global settings for all indexes.

Why this answer

indexes.conf uses index names as stanzas, and [default] for global settings.

Practice this question →

MCQeasy

Which configuration file is used to define index-time field extractions and line-breaking rules?

A.indexes.conf

B.transforms.conf

C.inputs.conf

D.props.conf

AnswerD

props.conf defines the parsing logic for data.

Why this answer

props.conf is the primary file for configuring how data is parsed, including line breaking and field extractions.

Practice this question →

MCQeasy

Which command is used to restart the Splunk service after modifying configuration files?

A.splunk stop-start

B.splunk refresh

C.splunk reload

D.splunk restart

AnswerD

This restarts the Splunk daemon.

Why this answer

'splunk restart' is the standard command to apply configuration changes by restarting the service.

Practice this question →

MCQmedium

What is the effect of setting 'TRANSFORMS-routing' in props.conf?

A.It invokes a named transform from transforms.conf

B.It routes the data to a specific app

C.It triggers an alert

D.It changes the sourcetype

AnswerA

The value points to a stanza in transforms.conf.

Why this answer

It instructs Splunk to process the data using a specific transform defined in transforms.conf.

Practice this question →

MCQeasy

Where is the global configuration for Splunk Enterprise stored?

A.$SPLUNK_HOME/etc/users/

B.$SPLUNK_HOME/etc/system/local/

C.$SPLUNK_HOME/var/lib/

D.$SPLUNK_HOME/etc/apps/

AnswerB

This directory contains the global configuration overrides.

Why this answer

$SPLUNK_HOME/etc/system/local is the location for global, system-wide configuration overrides.

Practice this question →

MCQhard

If you want to debug why a specific sourcetype is not applying, which btool command helps identify the configuration file responsible?

A.splunk list sourcetypes

B.splunk show props

C.splunk btool props list --debug

D.splunk inspect props

AnswerC

This command shows the merged configuration and the file source.

Why this answer

Using 'btool props list --debug' allows you to see exactly where the configuration is being pulled from.

Practice this question →

MCQhard

If a setting is defined in both $SPLUNK_HOME/etc/system/local/props.conf and $SPLUNK_HOME/etc/apps/my_app/default/props.conf, which one wins?

A.The App/default value

B.The app with the highest priority in app.conf

C.They are merged alphabetically

D.The System/local value

AnswerD

System/local overrides settings defined in application default directories.

Why this answer

System/local has a higher precedence than App/default.

Practice this question →

Multi-Selectmedium

Which TWO of the following are valid ways to define field extractions?

Select 2 answers

A.Directly in inputs.conf

B.Using the INDEXED-EXTRACTION attribute in transforms.conf

C.Using the EXTRACT- prefix in props.conf

D.Using a CSV file in etc/system/local

E.Using the REPORT- prefix in props.conf referencing a transform

AnswersC, E

This is a valid method for index-time extractions.

Why this answer

Field extractions can be defined using inline regex in props.conf or via transforms.conf.

Practice this question →

MCQmedium

What is the purpose of the 'TIME_PREFIX' attribute in props.conf?

A.To set the time format

B.To define the timezone

C.To specify the start of the timestamp

D.To truncate the timestamp

AnswerC

It helps Splunk find where the timestamp begins.

Why this answer

It specifies the regex pattern to locate the start of the timestamp in an event.

Practice this question →

MCQhard

You have two identical stanzas in different configuration files with the same precedence. How does Splunk determine which one wins?

A.The file with the largest size

B.It randomly chooses one

C.The file sorted alphabetically by name

D.The file created most recently

AnswerC

Splunk sorts files alphabetically and applies them in order when precedence is tied.

Why this answer

When precedence is tied, Splunk uses a deterministic method based on the filename, sorting alphabetically.

Practice this question →

MCQeasy

Which file would you edit to change the TCP listening port for a Splunk Universal Forwarder?

A.outputs.conf

B.props.conf

C.server.conf

D.inputs.conf

AnswerD

inputs.conf defines the listener.

Why this answer

inputs.conf is the standard file for configuring data inputs like TCP ports.

Practice this question →

Multi-Selectmedium

Which TWO of the following are true about 'local' versus 'default' directories?

Select 2 answers

A.'local' files are preserved during Splunk upgrades

B.Files in 'default' should be edited to update Splunk settings

C.'local' directories only exist in the system folder

D.The 'local' directory has higher precedence than 'default'

E.'default' files take precedence over 'local'

AnswersA, D

Local is the safe place for custom configurations.

Why this answer

Local overrides default, and local is where changes should be made to survive upgrades.

Practice this question →

Multi-Selectmedium

Which TWO directories are part of the standard Splunk configuration file precedence hierarchy?

Select 2 answers

A.$SPLUNK_HOME/var/run

B.$SPLUNK_HOME/etc/apps/app_name/default

C.$SPLUNK_HOME/etc/system/default

D.$SPLUNK_HOME/etc/licenses

E.$SPLUNK_HOME/etc/users/admin

AnswersB, C

This is part of the application hierarchy.

Why this answer

System and App directories are core parts of the configuration hierarchy.

Practice this question →

Multi-Selecthard

Which THREE of the following represent true statements about the 'transforms.conf' file?

Select 3 answers

A.It is used to perform data masking or anonymization

B.It is used to route data to different indexes

C.It is referenced by props.conf to perform extractions

D.It is the primary file for setting up TCP inputs

E.It is used to define the sourcetype of data

AnswersA, B, C

SEDCMD is used in props.conf, but transforms can also be used for filtering/routing which effectively anonymizes data.

Why this answer

transforms.conf is used for complex extractions, routing, and anonymization.

Practice this question →

Multi-Selecteasy

Which TWO of the following locations are valid for placing a custom 'inputs.conf' file?

Select 2 answers

A.$SPLUNK_HOME/etc/system/default/

B.$SPLUNK_HOME/etc/apps/my_app/local/

C.$SPLUNK_HOME/var/lib/

D.$SPLUNK_HOME/etc/system/local/

E.$SPLUNK_HOME/etc/apps/my_app/default/

AnswersB, D

Valid for app-specific settings.

Why this answer

Custom configs should be placed in local directories to follow best practices.

Practice this question →

MCQmedium

You have defined a setting in $SPLUNK_HOME/etc/system/local/inputs.conf and the same setting exists in $SPLUNK_HOME/etc/apps/my_app/local/inputs.conf. Which value takes precedence?

A.The system/local value

B.The configuration with the most recent timestamp

C.The app/local value

D.The configuration alphabetically first

AnswerC

App-level configurations take precedence over system-level configurations.

Why this answer

App-level local directory configurations override system-level local configurations.

Practice this question →

MCQeasy

Which file is responsible for defining how data is rotated in an index?

A.inputs.conf

B.props.conf

C.server.conf

D.indexes.conf

AnswerD

indexes.conf manages index retention and rotation.

Why this answer

indexes.conf contains settings like maxDataSize and maxHotSpanSecs which define data rotation.

Practice this question →

Multi-Selecthard

Which THREE of the following are true regarding the behavior of 'btool'?

Select 3 answers

A.It can check for configuration file syntax errors

B.It can modify configuration files directly

C.It can be used to restart the Splunk service

D.It displays the source file for each setting when used with --debug

E.It shows the final merged output of configurations

AnswersA, D, E

The 'check' command in btool validates syntax.

Why this answer

btool is a utility for viewing, checking, and debugging configuration files.

Practice this question →

MCQmedium

What is the purpose of the 'disabled=1' attribute in an inputs.conf stanza?

A.It errors out if the input is not found

B.It prevents the input from running

C.It deletes the input

D.It hides the input from the UI

AnswerB

Setting disabled=1 effectively turns off the data input.

Why this answer

The disabled attribute is used to stop an input from running without deleting the configuration.

Practice this question →

MCQmedium

Which stanza is required in props.conf to identify a sourcetype?

A.[default]

B.sourcetype = name

C.[sourcetype]

D.[source::name]

AnswerC

The name in brackets defines the sourcetype.

Why this answer

The sourcetype stanza is defined by the name enclosed in brackets, e.g., [my_sourcetype].

Practice this question →

MCQhard

How does Splunk handle configuration files that are missing a required attribute?

A.The engine ignores the attribute and uses defaults

B.The Splunk service fails to start

C.The file is marked as corrupted

D.The entire file is ignored

AnswerA

Splunk provides default values for missing attributes.

Why this answer

Splunk generally uses default values if an attribute is omitted, provided the stanza itself is valid.

Practice this question →

MCQmedium

When using transforms.conf to extract fields, what is the 'SOURCE_KEY' setting used for?

A.To specify which field the regex is applied to

B.To specify the index

C.To define the sourcetype

D.To set the time format

AnswerA

It allows redirection of the regex engine to a specific field.

Why this answer

SOURCE_KEY allows you to specify a different field (or the whole raw event) to apply the regex to, instead of the default '_raw'.

Practice this question →

MCQhard

What happens if you have a syntax error in a .conf file?

A.The system halts immediately

B.The configuration will be ignored and a warning logged

C.It is ignored silently

D.Splunk will automatically fix the syntax

AnswerB

Splunk reports syntax errors in the logs and ignores the problematic entries.

Why this answer

Splunk generally skips the malformed stanza or the entire file, depending on the severity, often logging a warning in splunkd.log.

Practice this question →

MCQeasy

A user reports that a setting in props.conf is not being applied. You want to see the final merged configuration for a specific sourcetype on a specific host. Which tool should you use?

A.splunk show-config

B.splunk cmd btool props list --debug

C.splunk edit props

D.splunk list configs

AnswerB

This command correctly lists the merged props.conf settings.

Why this answer

splunk btool is the standard CLI utility to show the merged configuration files for a specific context.

Practice this question →

Multi-Selectmedium

Which TWO attributes in props.conf are commonly used to handle multiline events?

Select 2 answers

A.INDEXED_EXTRACTION

B.TIME_FORMAT

C.TRANSFORMS-routing

D.BREAK_ONLY_BEFORE

E.SHOULD_LINEMERGE

AnswersD, E

This defines where a new event starts in a multiline block.

Why this answer

BREAK_ONLY_BEFORE and SHOULD_LINEMERGE are used for multiline event processing.

Practice this question →

MCQhard

When using btool, what does the output show by default?

A.Only the differences from defaults

B.The raw file contents

C.Only the changes made in /local

D.The merged configuration of all files

AnswerD

btool outputs the final, calculated configuration state.

Why this answer

By default, btool displays all configuration stanzas and settings merged from all files in the precedence order.

Practice this question →

MCQmedium

In props.conf, what does the 'REPORT-' prefix signify?

A.It triggers an alert

B.It defines an index-time extraction

C.It defines a search-time extraction

D.It defines a line-breaking rule

AnswerC

REPORT- defines search-time extractions associated with transforms.

Why this answer

REPORT- is used to associate a report-time extraction (often defined in transforms.conf) with a sourcetype.

Practice this question →

Multi-Selecthard

Which THREE configuration files are most critical for defining how data is ingested and parsed?

Select 3 answers

A.transforms.conf

B.server.conf

C.props.conf

D.indexes.conf

E.inputs.conf

AnswersA, C, E

Advanced parsing and routing.

Why this answer

inputs.conf, props.conf, and transforms.conf form the core of data processing.

Practice this question →

MCQmedium

You need to perform a regex-based routing operation to send data to different indexes based on the host. Which file must be configured to define the routing regex?

A.transforms.conf

B.indexes.conf

C.props.conf

D.inputs.conf

AnswerA

The routing regex is defined in transforms.conf.

Why this answer

transforms.conf is where the regex logic resides, while props.conf references the transform.

Practice this question →