Splunk Certified Admin - Online1 Flashcards
<p>Which authentication methods are natively supported within Splunk Enterprise? (Select all that apply) A. LDAP B. SAML C. RADIUS D. Duo Multifactor Authentication</p>
<p>A B C D</p>
<p>Which of the following are required when defining an index in indexes.conf? (Select all that apply.) A. coldPath B. homePath C. frozenPath D. thawedPath</p>
<p>A B D</p>
<p>Which of the following apply to how distributed search works? (Select all that apply.)
A. The search head dispatches searches to the peers.
B. The search peers pull the data from the forwarders.
C. Peers run searches in parallel and return their portion of results.
D. The search head consolidates the individual results and prepares reports.</p>
<p>A C D</p>
<p>What hardware attribute would you need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head? A. Disk B. CPUs C. Memory D. Network interface cards</p>
<p>B</p>
<p>In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?
A. To ensure that hot buckets are still open for writers and have not been forced to roll to a cold state.
B. To ensure that configuration files have not been tampered with for auditing and/or legal purposes.
C. To ensure that user passwords have not been tampered with for auditing and/or legal purposes.
D. To ensure that data has not been tampered with for auditing and/or legal purposes.</p>
<p>D</p>
<p>Which Splunk component performs indexing and responds to search requests from the search head? A. Forwarder B. Search peer C. License master D. Search head cluster</p>
<p>B</p>
<p>When deploying apps, which attribute in the forwarder management interface determines the apps that clients install? A. App Class B. Client Class C. Server Class D. Forwarder Class</p>
<p>C</p>
<p>In this sourcetype definition the MAX_TIMESTAMP_LOOKAHEAD is missing. Which value would fit best?
[sshd_syslog]
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N %z
LINE_BREAKER = ([rn]+)d{4}-d{2}-d{2} d{2}:d{2}:d{2}
SHOUD_LINEMERGE = false TRUNCATE = 0
Event example:
2018-04-13 13:42:41.214 -0500 server sshd[26219]: Connection from 172.0.2.60 port 47366
A. MAX_TIMESTAMP_LOOKAHEAD = 5
B. MAX_TIMESTAMP_LOOKAHEAD = 10
C. MAX_TIMESTAMP_LOOKAHEAD = 20
D. MAX_TIMESTAMP_LOOKAHEAD = 30</p><p>D</p>
<p>Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder? A. Any OS platform. B. Linux platform only. C. Windows platform only. D. None of the above.</p>
<p>A</p>
<p>What are the required stanza attributes when configuring the transforms.conf to manipulate or remove events? A. REGEX, DEST, FORMAT B. REGEX, SRC_KEY, FORMAT C. REGEX, DEST_KEY, FORMAT D. REGEX, DEST_KEY, FORMATTING</p>
<p>C</p>
<p>Which of the following indexes come pre-configured with Splunk Enterprise? (Select all that apply.) A. _licence B. _internal C. _external D. _thefishbucket</p>
<p>B D</p>
<p>How often does Splunk recheck the LDAP server?
A. Every 5 minutes.
B. Each time a user logs in.
C. Each time Splunk is restarted.
D. Varies based on LDAP_refresh setting.</p>
<p>B</p>
<p>Where are license files stored? A. $SPLUNK_HOME/etc/secure B. $SPLUNK_HOME/etc/system C. $SPLUNK_HOME/etc/licenses D. $SPLUNK_HOME/etc/apps/licenses</p>
<p>C</p>
<p>Which option accurately describes the purpose of the HTTP Event Collector (HEC)?
A. A token-based HTTP input that is secure and scalable and that requires the use of forwarders.
B. A token-based HTTP input that is secure and scalable and that does not require the use of forwarders.
C. An agent-based HTTP input that is secure and scalable and that does not require the use of forwarders.
D. A token-based HTTP input that is insecure and non-scalable and that does not require the use of forwarders.</p>
<p>B</p>
<p>What is the difference between the two wildcards … and * for the monitor stanza in inputs.conf?
A. … is not supported in monitor stanzas.
B. There is no difference, they are interchangeable and match anything beyond directory boundaries.
C. * matches anything in that specific directory path segment, whereas … recurses through subdirectories as well.
D. … matches anything in that specific directory path segment, whereas * recurses through subdirectories as well.</p>
<p>C</p>
<p>What type of data is counted against the Enterprise license at a fixed 150 bytes per event? A. License data B. Metrics data C. Internal Splunk data D. Internal Windows logs</p>
<p>B</p>
<p>Which valid bucket types are searchable? (Select all that apply.) A. Hot buckets B. Cold buckets C. Warm buckets D. Frozen buckets</p>
<p>A B C</p>
<p>How do you remove missing forwarders from the Monitoring Console?
A. By restarting Splunk.
B. By rescanning active forwarders.
C. By reloading the deployment server.
D. By rebuilding the forwarder asset table.</p>
<p>D</p>
<p>Which Splunk component does a search head primarily communicate with? A. Indexer B. Forwarder C. Cluster master D. Deployment server</p>
<p>A</p>
<p>Which layers are involved in Splunk configuration file layering? (Select all that apply.) A. App context B. User context C. Global context D. Forwarder context</p>
<p>A B C</p>
<p>Which of the following are methods for adding inputs in Splunk? (Select all that apply.) A. CLI B. Splunk Web C. Editing inputs.conf D. Editing monitor.conf</p>
<p>A B C</p>
<p>Which of the following authentication types requires scripting in Splunk? A. ADFS B. LDAP C. SAML D. RADIUS</p>
<p>D</p>
<p>Which of the following statements apply to directory inputs? (Select all that apply.)
A. All discovered text files are consumed.
B. Compressed files are ignored by default.
C. Splunk recursively traverses through the directory structure.
D. When adding new log files to a monitored directory, the forwarder must be restarted to take them into account.</p>
<p>A C</p>
