EMT Practice Test

1. Question Content...

---

Question1: Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

Question2: What is the difference between the two wildcards ... and - for the monitor stanza in inputs, conf?

Question3: Which of the following describes a Splunk deployment server?

Question4: Which is a valid stanza for a network input?

Question5: What is the command to reset the fishbucket for one source?

Question6: Which valid bucket types are searchable? (select all that apply)

Question7: Immediately after installation, what will a Universal Forwarder do first?

Question8: A security team needs to ingest a static file for a specific incident. The log file has not been collected previously and future updates to the file must not be indexed.
Which command would meet these needs?

Question9: In addition to single, non-clustered Splunk instances, what else can the deployment server push apps to?

Question10: What is an example of a proper configuration for CHARSET within props.conf?

Question11: In which phase of the index time process does the license metering occur?

Question12: What options are available when creating custom roles? (select all that apply)

Question13: Which of the following accurately describes HTTP Event Collector indexer acknowledgement?

Question14: Which setting allows the configuration of Splunk to allow events to span over more than one line?

Question15: After an Enterprise Trial license expires, it will automatically convert to a Free license. How many days is an Enterprise Trial license valid before this conversion occurs?

Question16: All search-time field extractions should be specified on which Splunk component?

Question17: A Splunk administrator has been tasked with developing a retention strategy to have frequently accessed data sets on SSD storage and to have older, less frequently accessed data on slower NAS storage. They have set a mount point for the NAS. Which parameter do they need to modify to set the path for the older, less frequently accessed data in indexes.conf?

Question18: When does a warm bucket roll over to a cold bucket?

Question19: The CLI command splunk add forward-server indexer:<receiving-port> will create stanza(s) in which configuration file?

Question20: Which of the following apply to how distributed search works? (select all that apply)

Question21: How is a remote monitor input distributed to forwarders?

Question22: A Universal Forwarder has the following active stanza in inputs . conf:
[monitor: //var/log]
disabled = O
host = 460352847
An event from this input has a timestamp of 10:55. What timezone will Splunk add to the event as part of indexing?

Question23: Which Splunk forwarder type allows parsing of data before forwarding to an indexer?

Question24: When configuring HTTP Event Collector (HEC) input, how would one ensure the events have been indexed?

Question25: Which option accurately describes the purpose of the HTTP Event Collector (HEC)?

Question26: Syslog files are being monitored on a Heavy Forwarder.
Where would the appropriate TRANSFORMS setting be deployed to reroute logs based on the event message?

Question27: What conf file needs to be edited to set up distributed search groups?

Question28: When using a directory monitor input, specific source types can be selectively overridden using which configuration file?

Question29: Which Splunk component would one use to perform line breaking prior to indexing?

Question30: What is the default character encoding used by Splunk during the input phase?

Question31: When deploying apps on Universal Forwarders using the deployment server, what is the correct component and location of the app before it is deployed?

Question32: Which feature in Splunk allows Event Breaking, Timestamp extractions, and any advanced configurations found in props.conf to be validated all through the UI?

Question33: Which Splunk configuration file is used to enable data integrity checking?

Question34: The LINE_BREAKER attribute is configured in which configuration file?

Question35: In which Splunk configuration is the SEDCMD used?

Question36: When running the command shown below, what is the default path in which deployment server. conf is created?
splunk set deploy-poll deployServer:port

Question37: In a distributed environment, which Splunk component is used to distribute apps and configurations to the other Splunk instances?

Question38: How is data handled by Splunk during the input phase of the data ingestion process?

Question39: Which of the following are required when defining an index in indexes. conf? (select all that apply)

Question40: When would the following command be used?

Question41: Which of the following are supported configuration methods to add inputs on a forwarder? (select all that apply)

Question42: An organization wants to collect Windows performance data from a set of clients, however, installing Splunk software on these clients is not allowed. What option is available to collect this data in Splunk Enterprise?

Question43: The Splunk administrator wants to ensure data is distributed evenly amongst the indexers. To do this, he runs the following search over the last 24 hours:
index=*
What field can the administrator check to see the data distribution?

Question44: Consider a company with a Splunk distributed environment in production. The Compliance Department wants to start using Splunk; however, they want to ensure that no one can see their reports or any other knowledge objects. Which Splunk Component can be added to implement this policy for the new team?

Question45: Which of the following monitor inputs stanza headers would match all of the following files?
/var/log/www1/secure.log
/var/log/www/secure.l
/var/log/www/logs/secure.logs
/var/log/www2/secure.log

Question46: Which default Splunk role could be assigned to provide users with the following capabilities?
Create saved searches
Edit shared objects and alerts
Not allowed to create custom roles

Question47: An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the default props.conf below, which SPLUNK_HOME/etc/users/buttercup/myTA/local/props.conf stanza can be added to the user's local context to disable the field aliases?

Question48: How do you remove missing forwarders from the Monitoring Console?

Question49: Where are deployment server apps mapped to clients?

Question50: What will the following inputs. conf stanza do?
[script://myscript . sh]
Interval=0

Question51: Which of the following statements describe deployment management? (select all that apply)

Question52: How can native authentication be disabled in Splunk?

Question53: Which file will be matched for the following monitor stanza in inputs. conf?

Question54: Which of the following are available input methods when adding a file input in Splunk Web? (Choose all that apply.)

Question55: What type of Splunk license is pre-selected in a brand new Splunk installation?

Question56: Given a forwarder with the following outputs.conf configuration:
[tcpout : mypartner]
Server = 145.188.183.184:9097
[tcpout : hfbank]
server = inputsl . mysplunkhfs . corp : 9997 , inputs2 . mysplunkhfs . corp : 9997 Which of the following is a true statement?

Question57: Which Splunk forwarder has a built-in license?

Question58: What is the valid option for a [monitor] stanza in inputs.conf?

Question59: Search heads in a company's European offices need to be able to search data in their New York offices. They also need to restrict access to certain indexers. What should be configured to allow this type of action?

Question60: Which configuration file would be used to forward the Splunk internal logs from a search head to the indexer?

Question61: Local user accounts created in Splunk store passwords in which file?

Question62: In this example, if useACK is set to true and the maxQueueSize is set to 7MB, what is the size of the wait queue on this universal forwarder?

Question63: Which artifact is required in the request header when creating an HTTP event?

Question64: What is the correct curl to send multiple events through HTTP Event Collector?

Question65: In case of a conflict between a whitelist and a blacklist input setting, which one is used?

Question66: Which Splunk component does a search head primarily communicate with?

Question67: Which of the following is the use case for the deployment server feature of Splunk?

Question68: In which phase do indexed extractions in props.conf occur?

Question69: Which of the following is an appropriate description of a deployment server in a non-cluster environment?

Question70: An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data is 300 GB per day. To minimize license issues, what is the best way to add 10 TB of historical data to the index?

Question71: The priority of layered Splunk configuration files depends on the file's:

Question72: Which of the following methods will connect a deployment client to a deployment server? (select all that apply)

Question73: Where are license files stored?

Question74: Within props. conf, which stanzas are valid for data modification? (select all that apply)

Question75: You update a props. conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btoo1 props list -debug. What will the output be?