SPLK-1003 by Splunk Actual Free Exam Questions And Answers

Question 1

What happens when the same username exists in Splunk as well as through LDAP?

A. LDAP user is automatically deleted from authentication.conf

B. Splunk settings take precedence.

C. LDAP settings take precedence.

D. Splunk user is automatically deleted from authentication.conf.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 2

There is an application cluster that produces logs with ISO-8859-5 character encoding.
Where should the props.confsetting be deployed to make these logs usable in Splunk?

A. On the Management Console

B. On the Universal Forwarders

C. On the Indexers

D. On the Search Head

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 3

Which of the following are supported options when configuring optional network inputs?

A. Metadata override, sender filtering options, network input queues (quantum queues)

B. Metadata override, sender filtering options, network input queues (memory/persistent queues)

C. Metadata override, receiver filtering options, network input queues (memory/persistent queues)

D. Filename override, sender filtering options, network output queues (memory/persistent queues)

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 4

Who provides the Application Secret, Integration, and Secret keys, as well as the API Hostname when setting up Duo for Multi-Factor Authentication in Splunk Enterprise?

A. SAML Administrator

B. LDAP Administrator

C. Duo Administrator

D. Trio Administrator

Discussion 0

Correct Answer: C Vote an answer

Question 5

Which additional component is required for a search head cluster?

A. Cluster Master

B. Management Console

C. Deployer

D. Monitoring Console

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 6

How is a remote monitor input distributed to forwarders?

A. As a monitor.conf file.

B. As a forward.conf file.

C. As an app.

D. As a forwarder monitor profile.

Discussion 0

Correct Answer: C Vote an answer

Question 7

When Splunk is integrated with LDAP, which attribute can be changed in the Splunk UI for an LDAP user?

A. LDAP group

B. Username

C. Default app

D. Password

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 8

In addition to single, non-clustered Splunk instances, what else can the deployment server push apps to?

A. Universal forwarders

B. Splunk Cloud

C. Windows using WMI

D. Linux package managers

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 9

When should the Data Preview feature be used?

A. When previewing the data before searching.

B. When extracting fields for ingested data.

C. When validating the parsing of data.

D. When reviewing data on the source host.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 10

Immediately after installation, what will a Universal Forwarder do first?

A. Begin reading local files on its server.

B. Begin generating internal Splunk logs.

C. Send an email to the operator that the installation process has completed.

D. Automatically detect any indexers in its subnet and begin routing data.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 11

Immediately after installation, what will a Universal Forwarder do first?

A. Begin reading local files on its server.

B. Begin generating internal Splunk logs.

C. Send an email to the operator that the installation process has completed.

D. Automatically detect any indexers in its subnet and begin routing data.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 12

On the deployment server, administrators can map clients to server classes using client filters.
Which of the following statements is accurate?

A. The whitelist takes precedence over the blacklist.

B. The blacklist takes precedence over the whitelist.

C. Machine type filters are applied before the whitelist and blacklist.

D. Wildcards are not supported in any client filters.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 13

How would you configure your distsearch.conf to allow you to run the search below?
sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON

A. [distributedSearch]
servers = nyc1:8089; nyc2:80894; houston1:8089; houston2:8089
[distributedSearch:NYC]
default = false
servers = ns1:8089; nyc2:8089
[distributedSearch:HOUSTON]
default = false
servers = houston1:80899448; houston2:80898915

B. [distributedSearch]
servers = nyc1:8089, nyc2:8089, houston1:8089, houston2:8089
[distributedSearch:NYC]
default = false
servers = nyc1:8089, nyc2:8089
[distributedSearch:HOUSTON]
default = false
servers = houston:8089, houston2:8089

C. [distributedSearch]
servers = nyc1, nyc2, houston1, houston2
[distributedSearch:NYC]
default = false
servers = nyc1, nyc2
[distributedSearch:HOUSTON]
default = false
servers = houston1, houston2

D. [distributedSearch:NYC]
default = false
servers = nyc1:8089, nyc2:8089
[distributedSearch:HOUSTON]

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 14

How would you configure your distsearch.conf to allow you to run the search below?
sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON

A. [distributedSearch:NYC]
default = false
servers = nyc1:8089, nyc2:8089
[distributedSearch:HOUSTON]
default = false
servers = houston1:8089, houston2:8089

B. [distributedSearch]
servers = nyc1:8089, nyc2:8089, houston1:8089, houston2:8089
[distributedSearch:NYC]
default = false
servers = nyc1:8089, nyc2:8089
[distributedSearch:HOUSTON]
default = false
servers = houston1:8089, houston2:8089

C. [distributedSearch]
servers = nyc1, nyc2, houston1, houston2
[distributedSearch: NYC]
default = false
servers = nyc1, nyc2
[distributedSearch:HOUSTON]
default = false
servers = houston1, houston2

D. [distributedSearch]
servers = nyc1:8089; nyc2:80894; houston1:8089; houston2:8089
[distributedSearch:NYC]
default = false
servers = nyc1:8089; nyc2:8089
[distributedSearch:HOUSTON]
default = false
servers = houston1:80899957; houston2:80899049

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 15

Where should apps be located on the deployment server that the clients pull from?

A. $SPLUNK HCME/etc/deployment-apps

B. $SFLUNK_KOME/etc/apps

C. $SPLUNK_HCME/etc/master-apps

D. $SPLUNK_HCME/etc/sear:ch

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Splunk Enterprise Certified Admin - SPLK-1003 Exam Practice Test

Contact Us

Useful Links

Latest Updated