EMT Practice Test

1. Question Content...

---

Question1: Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

Question2: Which setting allows the configuration of Splunk to allow events to span over more than one line?

Question3: Consider the following stanza in inputs.conf:

What will the value of the source filed be for events generated by this scripts input?

Question4: Within props. conf, which stanzas are valid for data modification? (select all that apply)

Question5: Which forwarder type can parse data prior to forwarding?

Question6: Which of the following types of data count against the license daily quota?

Question7: The Splunk administrator wants to ensure data is distributed evenly amongst the indexers. To do this, he runs the following search over the last 24 hours:
index=*
What field can the administrator check to see the data distribution?

Question8: Which Splunk component performs indexing and responds to search requests from the search head?

Question9: Which feature of Splunk's role configuration can be used to aggregate multiple roles intended for groups of users?

Question10: Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?

Question11: How is a remote monitor input distributed to forwarders?

Question12: Which of the following are supported configuration methods to add inputs on a forwarder? (select all that apply)

Question13: Consider a company with a Splunk distributed environment in production. The Compliance Department wants to start using Splunk; however, they want to ensure that no one can see their reports or any other knowledge objects. Which Splunk Component can be added to implement this policy for the new team?

Question14: Which additional component is required for a search head cluster?

Question15: Which of the following are required when defining an index in indexes. conf? (select all that apply)

Question16: After how many warnings within a rolling 30-day period will a license violation occur with an enforced Enterprise license?

Question17: What are the values for host and index for [stanza1] used by Splunk during index time, given the following configuration files?

Question18: Which setting in indexes. conf allows data retention to be controlled by time?

Question19: When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

Question20: What is the correct order of steps in Duo Multifactor Authentication?

Question21: An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the default props.conf below, which SPLUNK_HOME/etc/users/buttercup/myTA/local/props.conf stanza can be added to the user's local context to disable the field aliases?

Question22: User role inheritance allows what to be inherited from the parent role? (select all that apply)

Question23: In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?

Question24: A new forwarder has been installed with a manually created deploymentclient.conf.
What is the next step to enable the communication between the forwarder and the deployment server?

Question25: Which configuration file would be used to forward the Splunk internal logs from a search head to the indexer?

Question26: An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data is 300 GB per day. To minimize license issues, what is the best way to add 10 TB of historical data to the index?

Question27: Which of the following applies only to Splunk index data integrity check?

Question28: Which Splunk configuration file is used to enable data integrity checking?

Question29: Which optional configuration setting in inputs .conf allows you to selectively forward the data to specific indexer(s)?

Question30: Which valid bucket types are searchable? (select all that apply)

Question31: In addition to single, non-clustered Splunk instances, what else can the deployment server push apps to?

Question32: How often does Splunk recheck the LDAP server?

Question33: In this example, if useACK is set to true and the maxQueueSize is set to 7MB, what is the size of the wait queue on this universal forwarder?

Question34: Which authentication methods are natively supported within Splunk Enterprise? (select all that apply)

Question35: Which forwarder is recommended by Splunk to use in a production environment?

Question36: Assume a file is being monitored and the data was incorrectly indexed to an exclusive index. The index is cleaned and now the data must be reindexed. What other index must be cleaned to reset the input checkpoint information for that file?

Question37: In which phase do indexed extractions in props.conf occur?

Question38: What are the minimum required settings when creating a network input in Splunk?

Question39: The CLI command splunk add forward-server indexer:<receiving-port> will create stanza(s) in which configuration file?

Question40: When using license pools, volume allocations apply to which Splunk components?

Question41: Which data pipeline phase is the last opportunity for defining event boundaries?

Question42: In this source definition the MAX_TIMESTAMP_LOOKHEAD is missing. Which value would fit best?

Event example:

Question43: Which of the following monitor inputs stanza headers would match all of the following files?
/var/log/www1/secure.log
/var/log/www/secure.l
/var/log/www/logs/secure.logs
/var/log/www2/secure.log

Question44: The universal forwarder has which capabilities when sending data? (select all that apply)

Question45: Which Splunk component does a search head primarily communicate with?

Question46: In which phase of the index time process does the license metering occur?

Question47: Which of the following statements apply to directory inputs? {select all that apply)

Question48: Where are deployment server apps mapped to clients?

Question49: Which artifact is required in the request header when creating an HTTP event?