Splunk 7.x Fundmentals Part1 & Others Flashcards
1
Q
Machine data is always structured.
Select your answer.
True
False
A
False
2
Q
Machine data makes up for more than ___% of the data accumulated by organizations.
Select your answer. 10 90 25 50
A
90%
3
Q
Machine data is only generated by web servers.
Select your answer.
False
True
A
False
4
Q
Search requests are processed by the ___________.
Select your answer.
Forwarders
Indexers
Search Heads
A
Indexers
5
Q
A single-instance deployment of Splunk Enterprise handles:
Select all that apply. Indexing Input Searching Parsing
A
Indexing
Searching
Parsing
6
Q
Which of these is not a main component of Splunk?
Select your answer. Collect and index data Compress and archive Search and investigate Add knowledge
A
Compress and archive
7
Q
In most Splunk deployments, ________ serve as the primary way data is supplied for indexing.
Select your answer.
Search Heads
Forwarders
Local Files
A
Forwarders
8
Q
Which function is not a part of a single instance deployment?
Select your answer. Searching Indexing Clustering Parsing
A
Clustering
9
Q
Which apps ship with Splunk Enterprise?
Select all that apply. Sideview Utils DB Connect Search & Reporting Home App
A
Search & Reporting
Home App
10
Q
What are the three main default roles in Splunk Enterprise?
Select all that apply. Admin User King Manager Power
A
Admin
User
Power
11
Q
_________ define what users can do in Splunk.
Select your answer.
Tokens
Disk permissions
Roles
A
Roles
12
Q
You can launch and manage apps from the home app.
Select your answer.
False
True
A
True
13
Q
The password for a newly installed Splunk instance is:
Select your answer. Your email address. Randomly generated. Created when you install Splunk Enterprise. Available from the splunk.com website.
A
Created when you install Splunk Enterprise.
14
Q
This role will only see their own knowledge objects and those that have been shared with them.
Select your answer.
User
Admin
Power
A
User
15
Q
In most production environments, _______ will be used as the source of data input.
Fill in the blank.
A
Forwarders
16
Q
The monitor input option will allow you to continuously monitor files.
Select your answer.
True
False
A
True
17
Q
Splunk knows where to break the event, where the time stamp is located and how to automatically create field value pairs using these.
Select your answer.
Source types
Line breaks
File names
A
Source types
18
Q
Splunk uses ________ to categorize the type of data being indexed.
Fill in the blank.
A
source types
19
Q
Files indexed using the the upload input option get indexed _____.
Select your answer. Every hour On every search Once Each time Splunk restarts
A
Once
20
Q
The time stamp you see in the events is based on the time zone in your user account.
Select your answer.
True
False
A
True
21
Q
How is the asterisk used in Splunk search?
Select your answer. To make a nose for your clown emoticon As a wildcard As a place holder To add up numbers
A
As a wildcard
22
Q
Events are always returned in chronological order.
Select your answer.
True
False
A
False
23
Q
A search job will remain active for ___ minutes after it is run.
Select your answer. 10 30 5 90 20
A
10
24
Q
Commands that create statistics and visualizations are called _______________ commands.
Fill in the blank.
A
transforming
25
When zooming in on the event time line, a new search is run.
Select your answer.
False
True
False
26
When a search is sent to splunk, it becomes a _____.
```
Select your answer.
Search job
Task for Jimmy the Splunk elf
Event
File on the host system
```
Search job
27
What is the order of evaluation for Boolean operations in Splunk?
Drag and drop into the correct order.
AND
NOT
OR
NOT
OR
AND
28
These are booleans in the Splunk Search Language.
```
Select all that apply.
OR
IF
AND
NOT
```
OR
AND
NOT
29
Which following search mode toggles behavior based on the type of search being run?
Select your answer.
Fast
Verbose
Smart
Smart
30
These searches will return the same results.
failed password
failed AND password
Select your answer.
False
True
True
31
Wildcards cannot be used with field searches.
Select your answer.
True
False
False
32
What attributes describe the circled field below?
a dest 4
```
Select all that apply.
It contains numerical values
It contains 4 values.
It cannot be used in a search.
It contains string values.
```
It contains 4 values.
| It contains string values.
33
Field names are ________.
```
Select all that apply.
Always capitalized
Case insensitive
Case sensitive
Not important in Splunk
```
Case sensitive
34
Which is not a comparison operator in Splunk?
```
Select your answer.
?=
=
<=
!=
>
```
?=
35
Field values are case sensitive.
Select your answer.
False
True
False
36
As a general practice, exclusion is better than inclusion in a Splunk search.
Select your answer.
True
False
False
37
What is the most efficient way to filter events in Splunk?
Select your answer.
By time.
With an asterisk.
Using booleans.
By time.
38
Having separate indexes allows:
Select all that apply.
Ability to limit access.
Multiple retention policies
Faster Searches.
Ability to limit access.
Multiple retention policies
Faster Searches.
39
Time to search can only be set by the time range picker.
Select your answer.
True
False
False
40
This symbol is used in the "Advanced" section of the time range picker to round down to nearest unit of specified time.
```
Select your answer.
&
%
*
@
^
```
@
41
What is missing from this search?
sourcetype=a* | rename ip as "User IP" | table User IP
```
Select your answer.
Quotation marks around User IP.
Search terms
A table command.
A pipe.
```
Quotation marks around User IP.
42
Finish the rename command to change the name of the status field to HTTP Status.
sourcetype=a* status=404 | rename-----------------
```
Select your answer.
as "HTTP Status"
status to "HTTP Status"
status as "HTTP Status"
status as HTTP Status
```
status as "HTTP Status"
43
What command would you use to remove the status field from the returned events?
sourcetype=a* status=404 | ----------------- status
```
Select your answer.
table
fields -
fields
not
```
fields -
44
Excluding fields using the Fields Command will benefit performance.
Select your answer.
True
False
False
45
Would the ip column be removed in the results of this search? Why or why not?
sourcetype=a* | rename ip as "User" | fields - ip
Select your answer.
No, because table columns can not be removed.
Yes, because a pipe was used between search commands
No, because the name was changed.
Yes, because the negative sign was used.
No, because the name was changed.
46
To display the most common values in a specific field, what command would you use?
```
Select your answer.
all
table
top
rare
```
top
47
Which clause would you use to rename the count field?
sourcetype=vendor* | stats count ------- "Units Sold"
```
Select your answer.
rename
show
as
to
```
as
48
How many results are shown by default when using a Top or Rare Command?
Fill in the blank.
10
49
Which one of these is not a stats function?
```
Select your answer.
Sum
Count
Avg
List
Addtotals
```
Addtotals
50
Which stats function would you use to find the average value of a field?
Fill in the blank.
Avg
51
Charts can be based on numbers, time, or location.
Select your answer.
False
True
True
52
The User role can not create reports.
Select your answer.
True
False
False
53
A time range picker can be included in a report.
Select your answer.
True
False
True
54
If a search returns this, you can view the results as a chart.
```
Select your answer.
Numbers
Statistical values
A list.
Time limits.
```
Statistical values
55
In a dashboard, a time range picker will only work on panels that include a(n) __________ search.
```
Select your answer.
visualization
transforming
accelerated
inline
```
inline
56
These roles can create reports:
Select all that apply.
User
Admin
Power
User
Admin
Power
57
_____________ are reports gathered together into a single pane of glass.
```
Select your answer.
Dashboards
Alerts
Scheduled Reports
Panels
```
Dashboards
58
Adding child data model objects is like the ______ Boolean in the Splunk search language.
Select your answer.
OR
AND
NOT
AND
59
Pivots can be saved as dashboards panels.
Select your answer.
False
True
True
60
Data models are made up of ___________.
```
Select your answer.
Dashboard panels
Pivots
Datasets
Transforming searches
```
Datasets
61
Pivots cannot be saved as reports panels.
Select your answer.
True
False
False
62
These are knowledge objects that provide the data structure for pivot.
```
Select your answer.
Indexes
Data models
Alerts
Reports
```
Data models
63
Which role(s) can create data models?
Select all that apply.
Admin
Power
User
User
64
When using a .csv file for Lookups, the first row in the file represents this.
```
Select your answer.
Field names
Input fields
Output fields
Nothing, it is ignored
```
Field names
65
External data used by a Lookup can come from sources like:
```
Select all that apply.
None. Only internal data can be used.
Geospatial data
Scripts
CSV files
```
Geospatial data
Scripts
CSV files
66
Finish this search command so that it displays data from the http_status.csv Lookup file.
| ---------- http_status.csv
```
Select your answer.
inputlookup
lookup=*
lookup
datalookup
```
inputlookup
67
A lookup is categorized as a dataset.
Select your answer.
False
True
True
68
To keep from overwriting existing fields with your Lookup you can use the ____________ clause.
Fill in the blank.
OUTPUTNEW
69
Real-time alerts will run the search continuously in the background.
Select your answer.
False
True
True
70
Alerts can send an email.
Select your answer.
False
True
True
71
Alerts can run uploaded scripts.
Select your answer.
True
False
True
72
Alerts can be shared to all apps.
Select your answer.
True
False
True
73
Once an alert is created, you can no longer edit its defining search.
Select your answer.
True
False
False
74
An alert is an action triggered by a _____________.
```
Select your answer.
Report
Saved search
Selected field
Tag
```
Saved search
75
Splunk major parts
search heads
indexers
forwarders
76
What are the types of forwarders?
○ Universal Forwarder
○ Light Forwarder (deprecated)
○ Heavy Forwarder
77
How to install forwarders in large environments?
Deployment tools like SCCM, Ansible, or Chef
78
What are Splunk deployment schemes?
- small/non-distributed environment combining all parts in one instance less than 100 forwarders
- Enterprise/distributed environment: mini-indexers, search heads, 1000s of forwarders
- clustering: data replication (availability, fidelity, recovery), redundancy
79
What are the server roles?
```
Search Head,
Indexer,
Cluster Master,
License Master,
Deployment Server,
KV Store,
SHC Deployer
```
80
Splunk General tasks?
- Creating reports
- Creating dashboards
- Creating alerts
- Scheduled reports and alerts
81
Splunk SOC tasks?
- Centralized monitoring
- Event log collection
- Log correlation to identify IOCs
- Import syslog and local registry information into Splunk
- Create multiple compliance reports
82
PaloAlto Authentication
- Configuring Authentication
| - Using Two-Factor Authentication to Secure the Firewall
83
PaloAlto Decryption
- Decrypting SSH Traffic
| - Decrypting SSL Inbound Traffic
84
PaloAlto application Management
- Allowing Only Trusted Applications
| - Denying High Risk Apps
85
PaloAlto Responding to Attacks
Stopping Reconnaissance Attacks
Denying International Attackers
Using Dynamic Block Lists
86
Cisco ASA Tasks
Configure IPS
Configure NAT
Implement VPN via ASA Device Manager
87
pFsense tasks
PCAP Analysis
Analyze Network Traffic with pftop
Using syslog to identify access
88
Python?
- If statement, For, While loops
- If/else
- While loop
- Python functions
89
Powershell?
- Piping
- Scripting basics
- Common commands
90
Regex?
- Queries basics
- Building Regex:
* Extracting Data from Windows logs
* Extracting data from firwall logs
91
SQL?
- Statements: Select, Delte, Update, Insert
| - Creating Views
