EMT Practice Test

1. Question Content...

---

Question1: An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the defaultprops.confbelow, whichSPLUNK_HOME/etc/users/buttercup/myTA/local/props.confstanza can be added to the user's local context to disable the field aliases?

Question2: In which phase do indexed extractions in props.conf occur?

Question3: Which network input option provides durable file-system buffering of data to mitigate data loss due to network outages and splunkd restarts?

Question4: Which artifact is required in the request header when creating an HTTP event?

Question5: Which of the following applies only to Splunk index data integrity check?

Question6: To set up a Network input in Splunk, what needs to be specified'?

Question7: What hardware attribute would need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?

Question8: Which of the following are methods for adding inputs in Splunk? (select all that apply)

Question9: Which of the following apply to how distributed search works? (select all that apply)

Question10: Which Splunk component does a search head primarily communicate with?

Question11: When working with an indexer cluster, what changes with the global precedence when comparing to a standalone deployment?

Question12: When indexing a data source, which fields are considered metadata?

Question13: Which of the following is an appropriate description of a deployment server in a non-cluster environment?

Question14: Which of the following types of data count against the license daily quota?

Question15: In inputs. conf, which stanza would mean Splunk was only reading one local file?

Question16: Which forwarder type can parse data prior to forwarding?

Question17: On the deployment server, administrators can map clients to server classes using client filters. Which of the following statements is accurate?

Question18: Which Splunk component performs indexing and responds to search requests from the search head?

Question19: If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?

Question20: What is the default character encoding used by Splunk during the input phase?

Question21: Which of the following statements apply to directory inputs? {select all that apply)

Question22: Which parent directory contains the configuration files in Splunk?

Question23: Which of the following configuration files are used with a universal forwarder? (Choose all that apply.)

Question24: What action is required to enable forwarder management in Splunk Web?

Question25: After automatic load balancing is enabled on a forwarder, the time interval for switching indexers can be updated by using which of the following attributes?

Question26: Which of the following methods will connect a deployment client to a deployment server? (select all that apply)

Question27: All search-time field extractions should be specified on which Splunk component?

Question28: Consider the following stanza ininputs.conf:

What will the value of the source filed be for events generated by this scripts input?

Question29: Using the CLI on the forwarder, how could the current forwarder to indexer configuration be viewed?

Question30: What happens when there are conflicting settings within two or more configuration files?

Question31: When running a real-time search, search results are pulled from which Splunk component?

Question32: Which feature in Splunk allows Event Breaking, Timestamp extractions, and any advanced configurations found in props.conf to be validated all through the UI?

Question33: Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

Question34: Which additional component is required for a search head cluster?

Question35: Which feature of Splunk's role configuration can be used to aggregate multiple roles intended for groups of users?

Question36: Which of the following apply to how distributed search works? (select all that apply)

Question37: A log file contains 193 days worth of timestamped events. Which monitor stanza would be used to collect data
45 days old and newer from that log file?

Question38: The universal forwarder has which capabilities when sending data? (select all that apply)

Question39: What is the valid option for a [monitor] stanza in inputs.conf?

Question40: Which of the following statements describes how distributed search works?

Question41: What are the values forhostandindexfor[stanza1]used by Splunk during index time, given the following configuration files?

Question42: Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)

Question43: What options are available when creating custom roles? (select all that apply)

Question44: In addition to single, non-clustered Splunk instances, what else can the deployment server push apps to?

Question45: Which data pipeline phase is the last opportunity for defining event boundaries?

Question46: Which Splunk component would one use to perform line breaking prior to indexing?

Question47: When using license pools, volume allocations apply to which Splunk components?

Question48: Which of the following Splunk components require a separate installation package?

Question49: A Splunk administrator has been tasked with developing a retention strategy to have frequently accessed data sets on SSD storage and to have older, less frequently accessed data on slower NAS storage. They have set a mount point for the NAS. Which parameter do they need to modify to set the path for the older, less frequently accessed data in indexes.conf?

Question50: Which of the following are available input methods when adding a file input in Splunk Web? (Choose all that apply.)

Question51: Which Splunk configuration file is used to enable data integrity checking?

Question52: Which option on the Add Data menu is most useful for testing data ingestion without creating inputs.conf?

Question53: How would you configure your distsearch conf to allow you to run the search below?
sourcetype=access_combined status=200 action=purchase splunk_setver_group=HOUSTON

Question54: Which of the following indexes come pre-configured with Splunk Enterprise? (select all that apply)

Question55: An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data is 300 GB per day. To minimize license issues, what is the best way to add 10 TB of historical data to the index?

Question56: What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

Question57: What is an example of a proper configuration for CHARSET within props.conf?

Question58: How is data handled by Splunk during the input phase of the data ingestion process?

Question59: Which forwarder is recommended by Splunk to use in a production environment?

Question60: A Universal Forwarder is collecting two separate sources of data (A,B). Source A is being routed through a Heavy Forwarder and then to an indexer. Source B is being routed directly to the indexer. Both sets of data require the masking of raw text strings before being written to disk. What does the administrator need to do to ensure that the masking takes place successfully?

Question61: Which of the following accurately describes HTTP Event Collector indexer acknowledgement?

Question62: Which Splunk component requires a Forwarder license?

Question63: An organization wants to collect Windows performance data from a set of clients, however, installing Splunk software on these clients is not allowed. What option is available to collect this data in Splunk Enterprise?

Question64: In a distributed environment, which Splunk component is used to distribute apps and configurations to the other Splunk instances?

Question65: Which of the following monitor inputs stanza headers would match all of the following files?
/var/log/www1/secure.log
/var/log/www/secure.l
/var/log/www/logs/secure.logs
/var/log/www2/secure.log

Question66: What is required when adding a native user to Splunk? (select all that apply)

Question67: For single line event sourcetypes. it is most efficient to set SHOULD_linemerge to what value?

Question68: The priority of layered Splunk configuration files depends on the file's:

Question69: The CLI command splunk add forward-server indexer:<receiving-port> will create stanza(s) in which configuration file?

Question70: In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?

Question71: A configuration file in a deployed app needs to be directly edited. Which steps would ensure a successful deployment to clients?

Question72: Immediately after installation, what will a Universal Forwarder do first?

Question73: In a customer managed Splunk Enterprise environment, what is the endpoint URI used to collect data?