EMT Practice Test

1. Question Content...

---

Question1: When configuring HTTP Event Collector (HEC) input, how would one ensure the events have been indexed?

Question2: In this example, if useACK is set to true and the maxQueueSize is set to 7MB, what is the size of the wait queue on this universal forwarder?

Question3: Which Splunk component(s) would break a stream of syslog inputs into individual events? (select all that apply)

Question4: In addition to single, non-clustered Splunk instances, what else can the deployment server push apps to?

Question5: All search-time field extractions should be specified on which Splunk component?

Question6: Which setting in indexes. conf allows data retention to be controlled by time?

Question7: Which Splunk component performs indexing and responds to search requests from the search head?

Question8: How do you remove missing forwarders from the Monitoring Console?

Question9: How is a remote monitor input distributed to forwarders?

Question10: How would you configure your distsearch conf to allow you to run the search below? sourcetype=access_combined status=200 action=purchase splunk_setver_group=HOUSTON A)

B)

C)

D)

Question11: What is the default value of LINE_BREAKER?

Question12: Which forwarder is recommended by Splunk to use in a production environment?

Question13: What are the values for host and index for [stanza1] used by Splunk during index time, given the following configuration files?

Question14: Which Splunk forwarder has a built-in license?

Question15: When using a directory monitor input, specific source type can be selectively overridden using which configuration file?

Question16: Immediately after installation, what will a Universal Forwarder do first?

Question17: When deploying apps on Universal Forwarders using the deployment server, what is the correct component and location of the app before it is deployed?

Question18: Which additional component is required for a search head cluster?

Question19: Which is a valid stanza for a network input?

Question20: A log file contains 193 days worth of timestamped events. Which monitor stanza would be used to collect data 45 days old and newer from that log file?

Question21: After configuring a universal forwarder to communicate with an indexer, which index can be checked via the Splunk Web UI for a successful connection?

Question22: Which of the following is a valid distributed search group?

Question23: The LINE_BREAKER attribute is configured in which configuration file?

Question24: Which of the following is a benefit of distributed search?

Question25: A security team needs to ingest a static file for a specific incident. The log file has not been collected previously and future updates to the file must not be indexed.
Which command would meet these needs?

Question26: A Universal Forwarder has the following active stanza in inputs . conf:
[monitor: //var/log]
disabled = O
host = 460352847
An event from this input has a timestamp of 10:55. What timezone will Splunk add to the event as part of indexing?

Question27: When using license pools, volume allocations apply to which Splunk components?

Question28: A Universal Forwarder is collecting two separate sources of data (A,B). Source A is being routed through a Heavy Forwarder and then to an indexer. Source B is being routed directly to the indexer. Both sets of data require the masking of raw text strings before being written to disk. What does the administrator need to do to ensure that the masking takes place successfully?

Question29: When would the following command be used?

Question30: Given a forwarder with the following outputs.conf configuration:
[tcpout : mypartner]
Server = 145.188.183.184:9097
[tcpout : hfbank]
server = inputsl . mysplunkhfs . corp : 9997 , inputs2 . mysplunkhfs . corp : 9997 Which of the following is a true statement?

Question31: Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

Question32: What is the valid option for a [monitor] stanza in inputs.conf?

Question33: Which of the methods listed below supports muti-factor authentication?

Question34: Consider a company with a Splunk distributed environment in production. The Compliance Department wants to start using Splunk; however, they want to ensure that no one can see their reports or any other knowledge objects. Which Splunk Component can be added to implement this policy for the new team?

Question35: A user recently installed an application to index NCINX access logs. After configuring the application, they realize that no data is being ingested. Which configuration file do they need to edit to ingest the access logs to ensure it remains unaffected after upgrade?

Question36: Which of the following are methods for adding inputs in Splunk? (select all that apply)

Question37: Which of the following methods will connect a deployment client to a deployment server? (select all that apply)

Question38: Which artifact is required in the request header when creating an HTTP event?

Question39: What is required when adding a native user to Splunk? (select all that apply)

Question40: In a distributed environment, which Splunk component is used to distribute apps and configurations to the other Splunk instances?

Question41: After an Enterprise Trial license expires, it will automatically convert to a Free license. How many days is an Enterprise Trial license valid before this conversion occurs?

Question42: Which of the following apply to how distributed search works? (select all that apply)

Question43: Which configuration file would be used to forward the Splunk internal logs from a search head to the indexer?

Question44: Which option on the Add Data menu is most useful for testing data ingestion without creating inputs.conf?

Question45: Which authentication methods are natively supported within Splunk Enterprise? (select all that apply)

Question46: In which phase do indexed extractions in props.conf occur?

Question47: What is the valid option for a [monitor] stanza in inputs.conf?

Question48: During search time, which directory of configuration files has the highest precedence?

Question49: The universal forwarder has which capabilities when sending data? (select all that apply)

Question50: A non-clustered Splunk environment has three indexers (A,B,C) and two search heads (X, Y). During a search executed on search head X, indexer A crashes. What is Splunk's response?

Question51: You update a props. conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btoo1 props list -debug. What will the output be?

Question52: Windows can prevent a Splunk forwarder from reading open files. If files need to be read while they are being written to, what type of input stanza needs to be created?

Question53: Which feature in Splunk allows Event Breaking, Timestamp extractions, and any advanced configurations found in props.conf to be validated all through the UI?

Question54: Where can scripts for scripted inputs reside on the host file system? (select all that apply)

Question55: What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?

Question56: The volume of data from collecting log files from 50 Linux servers and 200 Windows servers will require multiple indexers. Following best practices, which types of Splunk component instances are needed?

Question57: When are knowledge bundles distributed to search peers?

Question58: Which Splunk configuration file is used to enable data integrity checking?

Question59: Which layers are involved in Splunk configuration file layering? (select all that apply)

Question60: Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

Question61: Which of the following statements apply to directory inputs? {select all that apply)

Question62: Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

Question63: The priority of layered Splunk configuration files depends on the file's:

Question64: Which Splunk component requires a Forwarder license?

Question65: The following stanza is active in indexes.conf:
[cat_facts]
maxHotSpanSecs = 3600
frozenTimePeriodInSecs = 2630000
maxTota1DataSizeMB = 650000
All other related indexes.conf settings are default values.
If the event timestamp was 3739283 seconds ago, will it be searchable?

Question66: Which of the following configuration files are used with a universal forwarder? (Choose all that apply.)

Question67: What event-processing pipelines are used to process data for indexing? (select all that apply)

Question68: What happens when the same username exists in Splunk as well as through LDAP?

Question69: What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?

Question70: An add-on has configured field aliases for source IP address and destination IP address fields. A specific user prefers not to have those fields present in their user context. Based on the default props.conf below, which SPLUNK_HOME/etc/users/buttercup/myTA/local/props.conf stanza can be added to the user's local context to disable the field aliases?

Question71: Which of the following must be done to define user permissions when integrating Splunk with LDAP?

Question72: What is the correct example to redact a plain-text password from raw events?

Question73: Syslog files are being monitored on a Heavy Forwarder.
Where would the appropriate TRANSFORMS setting be deployed to reroute logs based on the event message?

Question74: Which default Splunk role could be assigned to provide users with the following capabilities?
Create saved searches
Edit shared objects and alerts
Not allowed to create custom roles

Question75: Where are deployment server apps mapped to clients?

Question76: What hardware attribute would need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?

Question77: What is the correct curl to send multiple events through HTTP Event Collector?

Question78: Which of the following must be done to define user permissions when integrating Splunk with LDAP?

Question79: Event processing occurs at which phase of the data pipeline?

Question80: Which of the following Splunk components require a separate installation package?

Question81: What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

Question82: Running this search in a distributed environment:

On what Splunk component does the eval command get executed?

Question83: What will the following inputs. conf stanza do?
[script://myscript . sh]
Interval=0

Question84: Which forwarder type can parse data prior to forwarding?

Question85: Which parent directory contains the configuration files in Splunk?

Question86: When indexing a data source, which fields are considered metadata?

Question87: What is the command to reset the fishbucket for one source?

Question88: In a distributed environment, which Splunk component is used to distribute apps and configurations to the other Splunk instances?

Question89: Which of the following is the use case for the deployment server feature of Splunk?

Question90: Which of the following is an appropriate description of a deployment server in a non-cluster environment?

Question91: The Splunk administrator wants to ensure data is distributed evenly amongst the indexers. To do this, he runs the following search over the last 24 hours:
index=*
What field can the administrator check to see the data distribution?