EMT Practice Test

1. Question Content...

---

Question1: Which of the following are supported options when configuring optional network inputs?

Question2: Which of the following enables compression for universal forwarders in outputs. conf ?
A)

B)

C)

D)

Question3: Who provides the Application Secret, Integration, and Secret keys, as well as the API Hostname when setting up Duo for Multi-Factor Authentication in Splunk Enterprise?

Question4: If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?

Question5: In which phase do indexed extractions in props.conf occur?

Question6: In this source definition the MAX_TIMESTAMP_LOOKHEAD is missing. Which value would fit best?

Event example:

Question7: Which configuration file would be used to forward the Splunk internal logs from a search head to the indexer?

Question8: How would you configure your distsearch conf to allow you to run the search below?
sourcetype=access_combined status=200 action=purchase splunk_setver_group=HOUSTON A)

B)

C)

D)

Question9: Which parent directory contains the configuration files in Splunk?

Question10: Assume a file is being monitored and the data was incorrectly indexed to an exclusive index. The index is cleaned and now the data must be reindexed. What other index must be cleaned to reset the input checkpoint information for that file?

Question11: What is the correct order of steps in Duo Multifactor Authentication?

Question12: Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?

Question13: What is the default character encoding used by Splunk during the input phase?

Question14: This file has been manually created on a universal forwarder

A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new

Which file is now monitored?

Question15: Which forwarder type can parse data prior to forwarding?

Question16: Which Splunk component does a search head primarily communicate with?

Question17: Which feature of Splunk's role configuration can be used to aggregate multiple roles intended for groups of users?

Question18: Which of the following apply to how distributed search works? (select all that apply)

Question19: Which setting in indexes. conf allows data retention to be controlled by time?

Question20: Which additional component is required for a search head cluster?

Question21: Within props. conf, which stanzas are valid for data modification? (select all that apply)

Question22: In which Splunk configuration is the SEDCMD used?

Question23: What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

Question24: Which option accurately describes the purpose of the HTTP Event Collector (HEC)?

Question25: Where can scripts for scripted inputs reside on the host file system? (select all that apply)

Question26: The volume of data from collecting log files from 50 Linux servers and 200 Windows servers will require multiple indexers. Following best practices, which types of Splunk component instances are needed?

Question27: The universal forwarder has which capabilities when sending data? (select all that apply)

Question28: The Splunk administrator wants to ensure data is distributed evenly amongst the indexers. To do this, he runs the following search over the last 24 hours:
index=*
What field can the administrator check to see the data distribution?

Question29: You update a props. conf file while Splunk is running. You do not restart Splunk and you run this command:
splunk btoo1 props list -debug. What will the output be?

Question30: How is a remote monitor input distributed to forwarders?

Question31: Which of the following are available input methods when adding a file input in Splunk Web? (Choose all that apply.)

Question32: Which of the following authentication types requires scripting in Splunk?

Question33: For single line event sourcetypes. it is most efficient to set SHOULD_linemerge to what value?

Question34: Which authentication methods are natively supported within Splunk Enterprise? (select all that apply)

Question35: Which Splunk component distributes apps and certain other configuration updates to search head cluster members?