SPLK-1003 by Splunk Valid Free Exam Practice Test

Question 1

Which of the following configuration files are used with a universal forwarder? (Choose all that apply.)

A. forwarder.conf B. inputs.conf C. monitor.conf D. outputs.conf

Correct Answer: B,D

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 2

Which optional configuration setting in inputs .conf allows you to selectively forward the data to specific indexer(s)?

A. _TCP_ROUTING B. _INDEXER ROUTING C. _INDEXER_LIST D. _INDEXER_GROUP

Correct Answer: A

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 3

What type of Splunk license is pre-selected in a brand new Splunk installation?

A. Forwarder license B. Free license C. Enterprise trial license D. Enterprise license

Correct Answer: C

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 4

A bucket that was frozen and archived needs to be searchable. Which of the following correctly describes how the bucket can be reintroduced?

A. A frozen bucket can be thawed using a directory monitor. B. A frozen bucket can be thawed into any index on any indexer. C. A frozen bucket must be thawed into the original index on the original indexer. D. A frozen bucket must be thawed into the original index on any indexer.

Correct Answer: B

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 5

How would you configure your distsearch.conf to allow you to run the search below?
sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON

A. [distributedSearch]
servers = nyc1, nyc2, houston1, houston2
[distributedSearch:NYC]
default = false
servers = nyc1, nyc2
[distributedSearch:HOUSTON]
default = false
servers = houston1, houston2 B. [distributedSearch]
servers = nyc1:8089; nyc2:80894; houston1:8089; houston2:8089
[distributedSearch:NYC]
default = false
servers = ns1:8089; nyc2:8089
[distributedSearch:HOUSTON]
default = false
servers = houston1:80899448; houston2:80898915 C. [distributedSearch:NYC]
default = false
servers = nyc1:8089, nyc2:8089
[distributedSearch:HOUSTON] D. [distributedSearch]
servers = nyc1:8089, nyc2:8089, houston1:8089, houston2:8089
[distributedSearch:NYC]
default = false
servers = nyc1:8089, nyc2:8089
[distributedSearch:HOUSTON]
default = false
servers = houston:8089, houston2:8089

Correct Answer: D

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 6

In addition to single, non-clustered Splunk instances, what else can the deployment server push apps to?

A. Universal forwarders B. Splunk Cloud C. Linux package managers D. Windows using WMI

Correct Answer: A

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 7

As part of setting up Distributed Search, what capability on the Search Peer is required to authenticate access?

A. change_authentication B. edit_user C. edit_monitor D. edit_dist_peer

Correct Answer: D

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Question 8

Which of the following is true when authenticating users to Splunk using LDAP?

A. LDAP group names must match the Splunk role name defined in authorize.conf. B. LDAP will take precedence over local users with the same username as defined in etc/passwd. C. Splunk only supports encrypted LDAP connections. D. Splunk will search each LDAP strategy in the order in which they are listed in authentication.conf.

Correct Answer: D

Explanation: Only visible for ExamsLabs members. You can sign-up / login (it's free).

Splunk Enterprise Certified Admin - SPLK-1003 Exam Practice Test