Question 1

User role inheritance allows what to be inherited from the parent role? (Select all that apply.)

Accepted Answer

A)  Parents 
B)  Capabilities 
C)  Index access 
D)  Search history 
A)  Parents 
B)  Capabilities 
C)  Index access 
D)  Search history

Question 2

Which Splunk component does a search head primarily communicate with?

Accepted Answer

A)  Indexer 
B)  Forwarder 
C)  Cluster master 
D)  Deployment server 
A)  Indexer 
B)  Forwarder 
C)  Cluster master 
D)  Deployment server

Question 3

What hardware attribute would you need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?

Accepted Answer

A)  Disk 
B)  CPUs 
C)  Memory 
D)  Network interface cards 
A)  Disk 
B)  CPUs 
C)  Memory 
D)  Network interface cards

Question 4

Which of the following enables compression for universal forwarders in outputs.conf ?

Accepted Answer

A)  [ udpout:mysplunk_indexer11] compression=true [ udpout:mysplunk_indexer11] 
B)  [tcpout] defaultGroup=my_indexers compressed=true 
C)  /opt/splunkforwarder/bin/splunk enable compression 
D)  [ tcpount:my_indexers] server=mysplunk_indexer1:9997, mysplunk_indexer2:9997 decompression=false tcpount:my_indexers] server=mysplunk_indexer1:9997, mysplunk_indexer2:9997 
A)  [ udpout:mysplunk_indexer11] compression=true [ udpout:mysplunk_indexer11] 
B)  [tcpout] defaultGroup=my_indexers compressed=true 
C)  /opt/splunkforwarder/bin/splunk enable compression 
D)  [ tcpount:my_indexers] server=mysplunk_indexer1:9997, mysplunk_indexer2:9997 decompression=false tcpount:my_indexers] server=mysplunk_indexer1:9997, mysplunk_indexer2:9997

Question 5

Which parent directory contains the configuration files in Splunk?

Accepted Answer

A)  $SPLUNK_HOME/etc 
B)  $SPLUNK_HOME/var 
C)  $SPLUNK_HOME/conf 
D)  $SPLUNK_HOME/default 
A)  $SPLUNK_HOME/etc 
B)  $SPLUNK_HOME/var 
C)  $SPLUNK_HOME/conf 
D)  $SPLUNK_HOME/default

Question 6

When are knowledge bundles distributed to search peers?

Accepted Answer

A)  After a user logs in. 
B)  When Splunk is restarted. 
C)  When adding a new search peer. 
D)  When a distributed search is initiated. 
A)  After a user logs in. 
B)  When Splunk is restarted. 
C)  When adding a new search peer. 
D)  When a distributed search is initiated.

Question 7

During search time, which directory of configuration files has the highest precedence?

Accepted Answer

A)  $SPLUNK_HOME/etc/system/local 
B)  $SPLUNK_HOME/etc/system/default 
C)  $SPLUNK_HOME/etc/apps/app1/local 
D)  $SPLUNK_HOME/etc/ users /admin/local 
A)  $SPLUNK_HOME/etc/system/local 
B)  $SPLUNK_HOME/etc/system/default 
C)  $SPLUNK_HOME/etc/apps/app1/local 
D)  $SPLUNK_HOME/etc/ users /admin/local

Question 8

The CLI command splunk add forward-server indexer:<receiving-port> will create stanza(s) in which configuration file?

Accepted Answer

A)  inputs.conf 
B)  indexes.conf 
C)  outputs.conf 
D)  servers.conf 
A)  inputs.conf 
B)  indexes.conf 
C)  outputs.conf 
D)  servers.conf

Question 9

What are the required stanza attributes when configuring the transforms.conf to manipulate or remove events?

Accepted Answer

A)  REGEX, DEST, FORMAT 
B)  REGEX, SRC_KEY, FORMAT 
C)  REGEX, DEST_KEY, FORMAT 
D)  REGEX, DEST_KEY, FORMATTING 
A)  REGEX, DEST, FORMAT 
B)  REGEX, SRC_KEY, FORMAT 
C)  REGEX, DEST_KEY, FORMAT 
D)  REGEX, DEST_KEY, FORMATTING

Question 10

After how many warnings within a rolling 30-day period will a license violation occur with an enforced Enterprise license?

Accepted Answer

A)  1 
B)  3 
C)  4 
D)  5 
A)  1 
B)  3 
C)  4 
D)  5

Question 11

What is the difference between the two wildcards ... and * for the monitor stanza in inputs.conf ?

Accepted Answer

A)  ... is not supported in monitor stanzas. is not supported in monitor stanzas. 
B)  There is no difference, they are interchangeable and match anything beyond directory boundaries. 
C)  * matches anything in that specific directory path segment, whereas ... recurses through subdirectories as well. matches anything in that specific directory path segment, whereas recurses through subdirectories as well. 
D)  ... matches anything in that specific directory path segment, whereas * recurses through subdirectories as well. 
A)  ... is not supported in monitor stanzas. is not supported in monitor stanzas. 
B)  There is no difference, they are interchangeable and match anything beyond directory boundaries. 
C)  * matches anything in that specific directory path segment, whereas ... recurses through subdirectories as well. matches anything in that specific directory path segment, whereas recurses through subdirectories as well. 
D)  ... matches anything in that specific directory path segment, whereas * recurses through subdirectories as well.

Question 12

What is the correct order of steps in Duo Multifactor Authentication?

Accepted Answer

A)  1. Request Login 2. Connect to SAML server 3. Duo MFA 4. Create User session 5. Authentication Granted 6. Log into Splunk 
B)  2. Duo MFA 3. Authentication Granted 4. Connect to SAML server 5. Log into Splunk 6. Create User session 
C)  2. Check authentication / group mapping 4. Duo MFA 5. Create User session 
D)  3. Check authentication / group mapping 
A)  1. Request Login 2. Connect to SAML server 3. Duo MFA 4. Create User session 5. Authentication Granted 6. Log into Splunk 
B)  2. Duo MFA 3. Authentication Granted 4. Connect to SAML server 5. Log into Splunk 6. Create User session 
C)  2. Check authentication / group mapping 4. Duo MFA 5. Create User session 
D)  3. Check authentication / group mapping

Question 13

When does a warm bucket roll over to a cold bucket?

Accepted Answer

A)  When Splunk is restarted. 
B)  When the maximum warm bucket age has been reached. 
C)  When the maximum warm bucket size has been reached. 
D)  When the maximum number of warm buckets is reached. 
A)  When Splunk is restarted. 
B)  When the maximum warm bucket age has been reached. 
C)  When the maximum warm bucket size has been reached. 
D)  When the maximum number of warm buckets is reached.

Question 14

What options are available when creating custom roles? (Choose all that apply.)

Accepted Answer

A)  Restrict search terms. 
B)  Whitelist search terms. 
C)  Limit the number of concurrent search jobs. 
D)  Allow or restrict indexes that can be searched. 
A)  Restrict search terms. 
B)  Whitelist search terms. 
C)  Limit the number of concurrent search jobs. 
D)  Allow or restrict indexes that can be searched.

Question 15

Local user accounts created in Splunk store passwords in which file?

Accepted Answer

A)  $SPLUNK_HOME/etc/passwd 
B)  $SPLUNK_HOME/etc/authentication 
C)  $SPLUNK_HOME/etc/ users /passwd.conf 
D)  $SPLUNK_HOME/etc/ users /authentication.conf 
A)  $SPLUNK_HOME/etc/passwd 
B)  $SPLUNK_HOME/etc/authentication 
C)  $SPLUNK_HOME/etc/ users /passwd.conf 
D)  $SPLUNK_HOME/etc/ users /authentication.conf

Question 16

For single line event sourcetypes, it is most efficient to set SHOULD_LINEMERGE to what value?

Accepted Answer

A) true B) false C) D) Newline Character A) true B) false C) D) Newline Character

Question 17

Who provides the Application Secret, Integration, and Secret keys, as well as the API Hostname when setting up Duo for Multi-Factor Authentication in Splunk Enterprise?

Accepted Answer

A)  Duo Administrator 
B)  LDAP Administrator 
C)  SAML Administrator 
D)  Trio Administrator 
A)  Duo Administrator 
B)  LDAP Administrator 
C)  SAML Administrator 
D)  Trio Administrator

Question 18

Where are deployment server apps mapped to clients?

Accepted Answer

A)  Apps tab in forwarder management interface or clientapps.conf . Apps tab in forwarder management interface or clientapps.conf . 
B)  Clients tab in forwarder management interface or deploymentclient.conf . Clients tab in forwarder management interface or deploymentclient.conf 
C)  Server Classes tab in forwarder management interface or serverclass.conf . Server Classes tab in forwarder management interface or serverclass.conf 
D)  Client Applications tab in forwarder management interface or clientapps.conf . Client Applications tab in forwarder management interface or 
A)  Apps tab in forwarder management interface or clientapps.conf . Apps tab in forwarder management interface or clientapps.conf . 
B)  Clients tab in forwarder management interface or deploymentclient.conf . Clients tab in forwarder management interface or deploymentclient.conf 
C)  Server Classes tab in forwarder management interface or serverclass.conf . Server Classes tab in forwarder management interface or serverclass.conf 
D)  Client Applications tab in forwarder management interface or clientapps.conf . Client Applications tab in forwarder management interface or

Question 19

What is the default character encoding used by Splunk during the input phase?

Accepted Answer

A)  UTF-8 
B)  UTF-16 
C)  EBCDIC 
D)  ISO 8859 
A)  UTF-8 
B)  UTF-16 
C)  EBCDIC 
D)  ISO 8859

Question 20

In which phase of the index time process does the license metering occur?

Accepted Answer

A)  Input phase 
B)  Parsing phase 
C)  Indexing phase 
D)  Licensing phase 
A)  Input phase 
B)  Parsing phase 
C)  Indexing phase 
D)  Licensing phase

User role inheritance allows what to be inherited from the parent role? (Select all that apply.)

Which Splunk component does a search head primarily communicate with?

What hardware attribute would you need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?

Which of the following enables compression for universal forwarders in outputs.conf ?

Which parent directory contains the configuration files in Splunk?

When are knowledge bundles distributed to search peers?

During search time, which directory of configuration files has the highest precedence?

The CLI command splunk add forward-server indexer:<receiving-port> will create stanza(s) in which configuration file?

What are the required stanza attributes when configuring the transforms.conf to manipulate or remove events?

After how many warnings within a rolling 30-day period will a license violation occur with an enforced Enterprise license?

What is the difference between the two wildcards ... and * for the monitor stanza in inputs.conf ?

What is the correct order of steps in Duo Multifactor Authentication?

When does a warm bucket roll over to a cold bucket?

What options are available when creating custom roles? (Choose all that apply.)

Local user accounts created in Splunk store passwords in which file?

For single line event sourcetypes, it is most efficient to set SHOULD_LINEMERGE to what value?

Who provides the Application Secret, Integration, and Secret keys, as well as the API Hostname when setting up Duo for Multi-Factor Authentication in Splunk Enterprise?

Where are deployment server apps mapped to clients?

What is the default character encoding used by Splunk during the input phase?

In which phase of the index time process does the license metering occur?

Splunk Core Certified User

Splunk Enterprise Certified Admin

Splunk Enterprise Certified Architect

Splunk Enterprise Security Certified Admin

Splunk IT Service Intelligence Certified Admin

Splunk Core Certified Consultant

Filters

Exam 3: Splunk Certified Developer

User role inheritance allows what to be inherited from the parent role? (Select all that apply.)

Which Splunk component does a search head primarily communicate with?

What hardware attribute would you need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?

Which of the following enables compression for universal forwarders in outputs.conf ?

Which parent directory contains the configuration files in Splunk?

When are knowledge bundles distributed to search peers?

During search time, which directory of configuration files has the highest precedence?

The CLI command splunk add forward-server indexer:<receiving-port> will create stanza(s) in which configuration file?

What are the required stanza attributes when configuring the transforms.conf to manipulate or remove events?

After how many warnings within a rolling 30-day period will a license violation occur with an enforced Enterprise license?

What is the difference between the two wildcards ... and * for the monitor stanza in inputs.conf ?

What is the correct order of steps in Duo Multifactor Authentication?

When does a warm bucket roll over to a cold bucket?

What options are available when creating custom roles? (Choose all that apply.)

Local user accounts created in Splunk store passwords in which file?

For single line event sourcetypes, it is most efficient to set SHOULD_LINEMERGE to what value?

Who provides the Application Secret, Integration, and Secret keys, as well as the API Hostname when setting up Duo for Multi-Factor Authentication in Splunk Enterprise?

Where are deployment server apps mapped to clients?

What is the default character encoding used by Splunk during the input phase?

In which phase of the index time process does the license metering occur?

Splunk Core Certified User

Splunk Enterprise Certified Admin

Splunk Enterprise Certified Architect

Splunk Enterprise Security Certified Admin

Splunk IT Service Intelligence Certified Admin

Splunk Core Certified Consultant

Filters