EMT Practice Test

1. Question Content...

---

Question1: What is the name of the configuration file where you can specify the source type for a data input?

Question2: Which type of forwarder is a legacy option that is not recommended for new deployments?

Question3: What is the name of the configuration file that you need to edit to enable Data Preview for the search app?

Question4: Which configuration file contains the settings for event line breaking and line merging?

Question5: Which setting in inputs.conf can be used to specify the maximum size of a file that can be monitored by Splunk?

Question6: Which configuration file needs to be edited to configure the universal forwarder to act as a deployment client?

Question7: Which option can be used to specify the source type of the data when creating a file or directory monitor input?

Question8: What are the two options for Dynamic Data Storage in Splunk Cloud that allow you to move expired data from indexes to another storage location?

Question9: Which feature of forwarders can prevent data loss in case of network failure or congestion?

Question10: What is the name of the configuration file where you can set custom rules for event line breaking and line merging for a specific app?

Question11: Which Splunk add-on simplifies the process of getting data into Splunk Cloud Platform from Windows Event Log channels?

Question12: What is the name of the Splunk Enterprise feature that provides a security data and event management (SIEM) solution that uses machine data to detect and respond to threats?

Question13: What is the name of the process that breaks the stream of raw data into individual lines called events?

Question14: What is the name of the configuration file where you can define data transformations using regular expressions and other attributes?

Question15: Which command can be used to download and install the universal forwarder software on a Linux system?

Question16: Which type of forwarder is a full Splunk Enterprise instance that can run apps and add-ons?

Question17: Which type of forwarder can act as an intermediate forwarder to receive data from other forwarders and send it to the indexer?

Question18: What is the name of the process that breaks the stream of raw data into individual lines called events?

Question19: Which feature allows a light forwarder to reduce the amount of data sent to the indexer by discarding some events or fields?

Question20: Which configuration file determines how a universal forwarder forwards data to the indexer?

Question21: Which setting in inputs.conf can be used to set the host field to a static value for a monitor input?

Question22: What is the name of the Splunk Cloud feature that allows you to perform self-service administrative tasks such as creating indexes, inputs, and roles?

Question23: What is the main advantage of self-service Splunk Cloud over managed Splunk Cloud in terms of cost and control?

Question24: Which file processor can be used to index files that are not actively written to or updated?

Question25: What is the main difference between events indexes and metrics indexes in Splunk Cloud?

Question26: What is the name of the directory that contains all the Splunk indexes and other important data??

Question27: Which input type can be used to monitor Windows Registry Values for changes?

Question28: Which tool can be used to verify that data is actually being received on the specified port on the indexing server?

Question29: What is the regular expression format that represents any sequence of newlines and carriage returns, which is the default value of the LINE_BREAKER setting?

Question30: Which file processor can be used to index files that are locked by another process on Windows systems?

Question31: What is the name of the attribute that specifies the name of the stanza in the transforms.conf file that defines the data transformation in the props.conf file?

Question32: What is the name of the option that you need to check in Splunk Web to enable LDAP authentication for your Splunk Cloud Platform deployment?

Question33: What is the name of the topology that allows you to initiate searches from an on-premises Splunk Enterprise search head to a single Splunk Cloud Platform deployment?

Question34: What are the three types of data that indexes contain in Splunk Cloud?

Question35: What is the main advantage of self-service Splunk Cloud over managed Splunk Cloud in terms of cost and control?

Question36: Which setting in inputs.conf can be used to specify the SSL certificate for a TCP or UDP input?

Question37: Which Windows-specific input type allows Splunk software to read special Windows log files such as the DNS debug server log?