EMT Practice Test

1. Question Content...

---

Question1: Which configuration file would be used to forward the Splunk internal logs from a search head to the indexer?

Question2: What is required when adding a native user to Splunk? (select all that apply)

Question3: An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data is
300 GB per day. To minimize license issues, what is the best way to add 10 TB of historical data to the index?

Question4: Which of the following enables compression for universal forwarders in outputs. conf ?
A)

B)

C)

D)

Question5: In case of a conflict between a whitelist and a blacklist input setting, which one is used?

Question6: After configuring a universal forwarder to communicate with an indexer, which index can be checked via the Splunk Web UI for a successful connection?

Question7: Which is a valid stanza for a network input?

Question8: After configuring a universal forwarder to communicate with an indexer, which index can be checked via the Splunk Web UI for a successful connection?
index=main

Question9: After an Enterprise Trial license expires, it will automatically convert to a Free license. How many days is an Enterprise Trial license valid before this conversion occurs?

Question10: Who provides the Application Secret, Integration, and Secret keys, as well as the API Hostname when setting up Duo for Multi-Factor Authentication in Splunk Enterprise?

Question11: Which feature of Splunk's role configuration can be used to aggregate multiple roles intended for groups of users?

Question12: Which setting in indexes.confallows data retention to be controlled by time?

Question13: The volume of data from collecting log files from 50 Linux servers and 200 Windows servers will require multiple indexers. Following best practices, which types of Splunk component instances are needed?

Question14: How would you configure your distsearch.conf to allow you to run the search below?
sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON

Question15: Which of the following is a benefit of distributed search?

Question16: Which of the following is an appropriate description of a deployment server in a non-cluster environment?

Question17: Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

Question18: In a distributed environment, which Splunk component is used to distribute apps and configurations to the other Splunk instances?

Question19: Which of the following enables compression for universal forwarders in outputs. conf ?
A)

B)

C)

D)

Question20: How do you remove missing forwarders from the Monitoring Console?

Question21: When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

Question22: Which is a valid stanza for a network input?

Question23: In which Splunk configuration is the SEDCMDused?

Question24: In which Splunk configuration is the SEDCMD used?

Question25: If an update is made to an attribute in inputs.confon a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?

Question26: When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

Question27: Which of the following apply to how distributed search works? (Choose all that apply.)

Question28: When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

Question29: User role inheritance allows what to be inherited from the parent role? (select all that apply)

Question30: Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

Question31: The priority of layered Splunk configuration files depends on the file's:

Question32: Where are license files stored?

Question33: Which of the following statements describes how distributed search works?

Question34: Which Splunk component requires a Forwarder license?

Question35: Which of the following accurately describes HTTP Event Collector indexer acknowledgement?

Question36: Where are deployment server apps mapped to clients?

Question37: When are knowledge bundles distributed to search peers?

Question38: Which layers are involved in Splunk configuration file layering? (select all that apply)

Question39: In this source definition the MAX_TIMESTAMP_LOOKHEAD is missing. Which value would fit best?

Event example:

Question40: What is the default character encoding used by Splunk during the input phase?

Question41: Which Splunk component performs indexing and responds to search requests from the search head?

Question42: Which of the following configuration files are used with a universal forwarder? (Choose all that apply.)

Question43: Which of the following are supported configuration methods to add inputs on a forwarder? (Choose all that apply.)

Question44: Which of the following are supported options when configuring optional network inputs?

Question45: Which of the following indexes come pre-configured with Splunk Enterprise? (select all that apply)

Question46: Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

Question47: After how many warnings within a rolling 30-day period will a license violation occur with an enforced Enterprise license?

Question48: Which of the following are reasons to create separate indexes? (Choose all that apply.)

Question49: When using license pools, volume allocations apply to which Splunk components?

Question50: When does a warm bucket roll over to a cold bucket?

Question51: An index stores its data in buckets. Which default directories does Splunk use to store buckets? (Choose all that apply.)

Question52: For single line event sourcetypes, it is most efficient to set SHOULD_LINEMERGEto what value?

Question53: What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?

Question54: How often does Splunk recheck the LDAP server?

Question55: Where can scripts for scripted inputs reside on the host file system? (select all that apply)

Question56: Which of the following configuration files are used with a universal forwarder? (Choose all that apply.)

Question57: When configuring HTTP Event Collector (HEC) input, how would one ensure the events have been indexed?

Question58: Which option accurately describes the purpose of the HTTP Event Collector (HEC)?

Question59: Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?

Question60: What options are available when creating custom roles? (select all that apply)

Question61: What are the minimum required settings when creating a network input in Splunk?

Question62: What conf file needs to be edited to set up distributed search groups?

Question63: Which authentication methods are natively supported within Splunk Enterprise? (select all that apply)

Question64: What is required when adding a native user to Splunk? (select all that apply)

Question65: Within props.conf, which stanzas are valid for data modification? (Choose all that apply.)

Question66: User role inheritance allows what to be inherited from the parent role? (select all that apply)

Question67: Which of the following is a valid distributed search group?

Question68: Which of the following are methods for adding inputs in Splunk? (select all that apply)

Question69: Which optional configuration setting in inputs .conf allows you to selectively forward the data to specific indexer(s)?

Question70: When indexing a data source, which fields are considered metadata?

Question71: Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?

Question72: What is the difference between the two wildcards ... and - for the monitor stanza in inputs, conf?

Question73: Which valid bucket types are searchable? (Choose all that apply.)

Question74: Consider a company with a Splunk distributed environment in production. The Compliance Department wants to start using Splunk; however, they want to ensure that no one can see their reports or any other knowledge objects. Which Splunk Component can be added to implement this policy for the new team?

Question75: When configuring HTTP Event Collector (HEC) input, how would one ensure the events have been indexed?

Question76: How is a remote monitor input distributed to forwarders?

Question77: Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

Question78: When running the command shown below, what is the default path in which deployment server. conf is created?
splunk set deploy-poll deployServer:port

Question79: In case of a conflict between a whitelist and a blacklist input setting, which one is used?

Question80: Which of the following are supported configuration methods to add inputs on a forwarder? (select all that apply)

Question81: What conf file needs to be edited to set up distributed search groups?

Question82: Which of the following enables compression for universal forwarders in outputs.conf?

Question83: When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

Question84: In case of a conflict between a whitelist and a blacklist input setting, which one is used?

Question85: Which of the following are methods for adding inputs in Splunk? (Select all that apply.)

Question86: Which setting in indexes.confallows data retention to be controlled by time?

Question87: The Splunk administrator wants to ensure data is distributed evenly amongst the indexers. To do this, he runs the following search over the last 24 hours:
index=*
What field can the administrator check to see the data distribution?

Question88: How do you remove missing forwarders from the Monitoring Console?

Question89: Which Splunk component does a search head primarily communicate with?

Question90: Which Splunk component requires a Forwarder license?

Question91: When are knowledge bundles distributed to search peers?

Question92: Which feature in Splunk allows Event Breaking, Timestamp extractions, and any advanced configurations found in props.conf to be validated all through the UI?

Question93: Which Splunk component does a search head primarily communicate with?

Question94: On the deployment server, administrators can map clients to server classes using client filters. Which of the following statements is accurate?

Question95: Which of the following are supported options when configuring optional network inputs?

Question96: In a distributed environment, which Splunk component is used to distribute apps and configurations to the other Splunk instances?

Question97: On the deployment server, administrators can map clients to server classes using client filters. Which of the following statements is accurate?

Question98: Which of the following configuration files are used with a universal forwarder? (Choose all that apply.)

Question99: The volume of data from collecting log files from 50 Linux servers and 200 Windows servers will require multiple indexers. Following best practices, which types of Splunk component instances are needed?

Question100: Which option accurately describes the purpose of the HTTP Event Collector (HEC)?

Question101: When Splunk is integrated with LDAP, which attribute can be changed in the Splunk UI for an LDAP user?

Question102: What hardware attribute would you need to be changed to increase the number of simultaneous searches (ad- hoc and scheduled) on a single search head?

Question103: What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

Question104: In which phase do indexed extractions in props.conf occur?

Question105: How would you configure your distsearch conf to allow you to run the search below?
sourcetype=access_combined status=200 action=purchase splunk_setver_group=HOUSTON A)

B)

C)

D)

Question106: How often does Splunk recheck the LDAP server?

Question107: Which of the following are supported configuration methods to add inputs on a forwarder? (select all that apply)

Question108: Which of the following apply to how distributed search works? (select all that apply)

Question109: An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the default props.conf below, which SPLUNK_HOME/etc/users/buttercup/myTA/local/props.conf stanza can be added to the user's local context to disable the field aliases?

Question110: When running a real-time search, search results are pulled from which Splunk component?

Question111: If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?

Question112: The universal forwarder has which capabilities when sending data? (Select all that apply.)

Question113: Which option on the Add Data menu is most useful for testing data ingestion without creating inputs.conf?

Question114: Which of the following apply to how distributed search works? (select all that apply)

Question115: How can native authentication be disabled in Splunk?

Question116: Which of the following statements describe deployment management? (select all that apply)

Question117: Which of the following is accurate regarding the input phase?

Question118: What is the correct order of steps in Duo Multifactor Authentication?

Question119: Which of the following are required when defining an index in indexes.conf? (Choose all that apply.)

Question120: In which Splunk configuration is the SEDCMD used?

Question121: You update a props.conffile while Splunk is running. You do not restart Splunk and you run this command:
splunk btool props list --debug. What will the output be?

Question122: Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)

Question123: Which layers are involved in Splunk configuration file layering? (select all that apply)

Question124: Which setting in indexes. conf allows data retention to be controlled by time?

Question125: What options are available when creating custom roles? (Choose all that apply.)

Question126: What is the difference between the two wildcards ... and - for the monitor stanza in inputs, conf?

Question127: All search-time field extractions should be specified on which Splunk component?

Question128: What is the valid option for a [monitor] stanza in inputs.conf?

Question129: The priority of layered Splunk configuration files depends on the file's:

Question130: In which phase of the index time process does the license metering occur?

Question131: Which of the following statements apply to directory inputs? {select all that apply)

Question132: User role inheritance allows what to be inherited from the parent role? (select all that apply)

Question133: When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

Question134: Where should apps be located on the deployment server that the clients pull from?

Question135: What options are available when creating custom roles? (Select all that apply.)

Question136: Which of the following is a benefit of distributed search?

Question137: In which Splunk configuration is the SEDCMDused?

Question138: Where are deployment server apps mapped to clients?

Question139: What is required when adding a native user to Splunk? (Choose all that apply.)