EMT Practice Test

1. Question Content...

---

Question1: Which of the following statements describes how distributed search works?

Question2: In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?

Question3: After an Enterprise Trial license expires, it will automatically convert to a Free license. How many days is an Enterprise Trial license valid before this conversion occurs?

Question4: You update a props. conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btoo1 props list -debug. What will the output be?

Question5: What options are available when creating custom roles? (select all that apply)

Question6: Where can scripts for scripted inputs reside on the host file system? (select all that apply)

Question7: Which Splunk component requires a Forwarder license?

Question8: Where are license files stored?

Question9: Which layers are involved in Splunk configuration file layering? (select all that apply)

Question10: Which of the following are supported configuration methods to add inputs on a forwarder? (select all that apply)

Question11: Which of the following statements describe deployment management? (select all that apply)

Question12: When indexing a data source, which fields are considered metadata?

Question13: An index stores its data in buckets. Which default directories does Splunk use to store buckets? (Choose all that apply.)

Question14: Which of the following applies only to Splunk index data integrity check?

Question15: What is required when adding a native user to Splunk? (select all that apply)

Question16: To set up a Network input in Splunk, what needs to be specified'?

Question17: Which option accurately describes the purpose of the HTTP Event Collector (HEC)?

Question18: User role inheritance allows what to be inherited from the parent role? (select all that apply)

Question19: For single line event sourcetypes. it is most efficient to set SHOULD_linemerge to what value?

Question20: Which Splunk configuration file is used to enable data integrity checking?

Question21: What is the valid option for a [monitor] stanza in inputs.conf?

Question22: When does a warm bucket roll over to a cold bucket?

Question23: Which of the following is a benefit of distributed search?

Question24: In case of a conflict between a whitelist and a blacklist input setting, which one is used?

Question25: What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?

Question26: When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

Question27: Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)

Question28: When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

Question29: Which of the following must be done to define user permissions when integrating Splunk with LDAP?

Question30: Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?

Question31: When running the command shown below, what is the default path in which deployment server. conf is created?
splunk set deploy-poll deployServer:port

Question32: Which feature of Splunk's role configuration can be used to aggregate multiple roles intended for groups of users?

Question33: Which Splunk forwarder has a built-in license?

Question34: What is the default value of LINE_BREAKER?

Question35: When running the command shown below, what is the default path in which deployment server. conf is created?
splunk set deploy-poll deployServer:port

Question36: The universal forwarder has which capabilities when sending data? (select all that apply)

Question37: Which Splunk component does a search head primarily communicate with?

Question38: Who provides the Application Secret, Integration, and Secret keys, as well as the API Hostname when setting up Duo for Multi-Factor Authentication in Splunk Enterprise?

Question39: Which of the following are methods for adding inputs in Splunk? (select all that apply)

Question40: Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field resulting output: [22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309 Event:
[22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309

Question41: What conf file needs to be edited to set up distributed search groups?

Question42: The CLI command splunk add forward-server indexer:<receiving-port> will create stanza(s) in which configuration file?