Exam 5: Splunk Enterprise Security Certified Admin

Which two sections can be expanded using the Search Job Inspector?

What is the logical first step when starting a deployment plan?

Which Splunk internal index contains license-related events?

Which of the following statements describe a Search Head Cluster (SHC) captain? (Select all that apply.)

Which of the following statements describe search head clustering? (Select all that apply.)

Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index. Which of the following logs are included in this index? (Select all that apply.)

Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?

Which of the following are true statements about Splunk indexer clustering?

In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?

To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?

In which phase of the Splunk Enterprise data pipeline are indexed extraction configurations processed?

A Splunk instance has the following settings in SPLUNK_HOME/etc/system/local/server.conf: [clustering] mode = master replication_factor = 2 pass4SymmKey = password123 Which of the following statements describe this Splunk instance? (Select all that apply.)

In a distributed environment, knowledge object bundles are replicated from the search head to which location on the search peer(s)?

What is the minimum reference server specification for a Splunk indexer?

Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

Which search head cluster component is responsible for pushing knowledge bundles to search peers, replicating configuration changes to search head cluster members, and scheduling jobs across the search head cluster?

How does the average run time of all searches relate to the available CPU cores on the indexers?

Which of the following clarification steps should be taken if apps are not appearing on a deployment client? (Select all that apply.)