EMT Practice Test

1. Question Content...

---

Question1: Which of the following is an accurate statement about the delete command?

Question2: Which of the following is not a path used by Splunk to execute scripts?

Question3: What is a private app?

Question4: Which of the following is the default bandwidth limit in the Splunk Universal Forwarder credentials package?

Question5: Which of the following is a valid stanza in props. conf?

Question6: Which of the following app installation scenarios can be achieved without involving Splunk Support?

Question7: Which of the following are features of a managed Splunk Cloud environment?

Question8: When monitoring network inputs, there will be times when the forwarder is unable to send data to the indexers. Splunk uses a memory queue and a disk queue. Which setting is used for the disk queue?

Question9: In what scenarios would transforms.conf be used?

Question10: Which monitor statement will retrieve only files that start with "access" in the directory /opt/log/ww2/?

Question11: The following Apache access log is being ingested into Splunk via a monitor input:

How does Splunk determine the time zone for this event?

Question12: Where is the recommended place to deploy input apps that are not permitted on Splunk Cloud?

Question13: When a forwarder phones home to a Deployment Server it compares the check-sum value of the forwarder's app to the Deployment Server's app. What happens to the app If the check-sum values do not match?

Question14: Which statement is true about monitor inputs?

Question15: Which of the following stanzas would enable a TCP input on port 1025, allowing traffic from all IP addresses except 10.5.5.1?

Question16: What can be used in a Splunk Cloud environment to create new sourcetypes?

Question17: What is the recommended method to test the onboarding of a new data source before putting it in production?

Question18: When is data deleted from a Splunk Cloud index?

Question19: In which file can the SH0ULD_LINEMERCE setting be modified?

Question20: Which file or folder below is not a required part of a deployment app?

Question21: Which of the following statements is true about data transformations using SEDCMD?

Question22: Where does the regex replacement processor run?

Question23: In which of the following situations should Splunk Support be contacted?

Question24: Which of the following tasks is not managed by the Splunk Cloud administrator?

Question25: Which of the following takes place during the input phase?

Question26: What is the recommended approach to collect data from network devices?

Question27: The following sample log event shows evidence of credit card numbers being present in the transactions. loc file.

Which of these SEDCM3 settings will mask this and other suspected credit card numbers with an Y character for each character being masked? The indexed event should be formatted as follows:

Question28: Files from multiple systems are being stored on a centralized log server. The files are organized into directories based on the original server they came from. Which of the following is a recommended approach for correctly setting the host values based on their origin?

Question29: Which of the following is true when integrating LDAP authentication?

Question30: A customer wants to mask unstructured data before sending it to Splunk Cloud. Where should SEBCMD be configured for this?