EMT Practice Test

1. Question Content...

---

Question1: Which of the following statements apply to directory inputs? {select all that apply)

Question2: After automatic load balancing is enabled on a forwarder, the time interval for switching indexers can be updated by using which of the following attributes?

Question3: In which phase of the index time process does the license metering occur?

Question4: Which of the following are supported configuration methods to add inputs on a forwarder? (select all that apply)

Question5: Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field resulting output: [22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309 Event:
[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309

Question6: What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?

Question7: Which of the following indexes come pre-configured with Splunk Enterprise? (select all that apply)

Question8: The universal forwarder has which capabilities when sending data? (select all that apply)

Question9: On the deployment server, administrators can map clients to server classes using client filters. Which of the following statements is accurate?

Question10: Which option on the Add Data menu is most useful for testing data ingestion without creating inputs.conf?

Question11: Which of the following are supported options when configuring optional network inputs?

Question12: Which setting in indexes. conf allows data retention to be controlled by time?

Question13: What is required when adding a native user to Splunk? (select all that apply)

Question14: A log file contains 193 days worth of timestamped events. Which monitor stanza would be used to collect data 45 days old and newer from that log file?

Question15: In which Splunk configuration is the SEDCMD used?

Question16: User role inheritance allows what to be inherited from the parent role? (select all that apply)

Question17: How do you remove missing forwarders from the Monitoring Console?

Question18: Which Splunk component does a search head primarily communicate with?

Question19: An index stores its data in buckets. Which default directories does Splunk use to store buckets? (Choose all that apply.)

Question20: Which of the following enables compression for universal forwarders in outputs. conf ?
A)

B)

C)

D)

Question21: Which of the following is valid distribute search group?
A)

B)

C)

D)

Question22: Which feature in Splunk allows Event Breaking, Timestamp extractions, and any advanced configurations found in props.conf to be validated all through the UI?

Question23: What is the difference between the two wildcards ... and - for the monitor stanza in inputs, conf?

Question24: When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

Question25: Which layers are involved in Splunk configuration file layering? (select all that apply)

Question26: Which valid bucket types are searchable? (select all that apply)

Question27: After automatic load balancing is enabled on a forwarder, the time interval for switching indexers can be updated by using which of the following attributes?

Question28: The priority of layered Splunk configuration files depends on the file's:

Question29: What options are available when creating custom roles? (select all that apply)

Question30: Which of the following are methods for adding inputs in Splunk? (select all that apply)

Question31: Which parent directory contains the configuration files in Splunk?

Question32: When does a warm bucket roll over to a cold bucket?

Question33: What are the minimum required settings when creating a network input in Splunk?

Question34: To set up a Network input in Splunk, what needs to be specified'?

Question35: In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?

Question36: When running the command shown below, what is the default path in which deployment server. conf is created?
splunk set deploy-poll deployServer:port

Question37: Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

Question38: What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

Question39: Which option accurately describes the purpose of the HTTP Event Collector (HEC)?

Question40: The Splunk administrator wants to ensure data is distributed evenly amongst the indexers. To do this, he runs the following search over the last 24 hours:
index=*
What field can the administrator check to see the data distribution?

Question41: Which of the following applies only to Splunk index data integrity check?

Question42: When running a real-time search, search results are pulled from which Splunk component?