EMT Practice Test

1. Question Content...

---

Question1: Which configuration shown is used to enable a forwarder as a deployment client of the server 10.1.2.3?

Question2: Which of the following tasks is the responsibility of a Splunk Cloud administrator?

Question3: What can be used in a Splunk Cloud environment to create new sourcetypes?

Question4: What information is identified during the input phase of the ingestion process?

Question5: In what scenarios would transforms.conf be used?

Question6: What is the correct syntax to monitor /apache/too/logo, /apache/bor/logs, and /apache/bar/l/logo?

Question7: How is the forwarder configuration app for Splunk Cloud obtained?

Question8: What is the recommended approach to collect data from network devices?

Question9: Which monitor statement will retrieve only files that start with "access" in the directory /opt/log/ww2/?

Question10: Where can an administrator download the Splunk Cloud Universal Forwarder credentials package?

Question11: Which of the following statements regarding apps in Splunk Cloud is true?

Question12: Where does the regex replacement processor run?

Question13: Configuration folders named default contain configuration files/settings specified in the Splunk product or default settings specified in apps. Which of the following is recommended to override these settings?

Question14: Which of the following statements is true regarding sedcmd?

Question15: What is the recommended method to test the onboarding of a new data source before putting it in production?

Question16: What is the name of the Splunk index that contains the most valuable information for troubleshooting a Splunk issue?

Question17: When is data deleted from a Splunk Cloud index?

Question18: The following Apache access log is being ingested into Splunk via a monitor input:

How does Splunk determine the time zone for this event?

Question19: Consider the following configurations:

What is the value of the sourcetype property for this stanza based on Splunk's configuration file precedence?

Question20: Where is the recommended place to deploy input apps that are not permitted on Splunk Cloud?

Question21: For the following data, what would be the correct attribute/value oair to use to successfully extract the correct timestamp from all the events?

Question22: Which of the following is a valid monitor stanza for inputs.conf?

Question23: Which file or folder below is not a required part of a deployment app?

Question24: A monitor has been created in inputs. con: for a directory that contains a mix of file types.
How would a Cloud Admin fine-tune assigned sourcetypes for different files in the directory during the input phase?

Question25: Which of the following are valid settings for file and directory monitor inputs?

Question26: When adding a directory monitor and specifying a sourcetype explicitly, it applies to all files in the directory and subdirectories. If automatic sourcetyping is used, a user can selectively override it in which file on the forwarder?

Question27: What two files are used in the data transformation process?

Question28: What syntax is required in inputs.conf to ingest data from files or directories?

Question29: A user has been asked to mask some sensitive data without tampering with the structure of the file /var/log
/purchase/transactions. log that has the following format:

Question30: What is a private app?

Question31: A customer has worked with their LDAP administrator to configure an LDAP strategy in Splunk. The configuration works, and user Mia can log into Splunk using her LDAP Account. After some time, the Splunk Cloud administrator needs to move Mia from the user role to the power role. How should they accomplish this?

Question32: Which of the following is correct in regard to configuring a Universal Forwarder as an Intermediate Forwarder?

Question33: Which of the following is the default bandwidth limit in the Splunk Universal Forwarder credentials package?

Question34: In Splunk terminology, what is an index?

Question35: What does the followTail attribute do in inputs.conf?

Question36: When a forwarder phones home to a Deployment Server it compares the check-sum value of the forwarder's app to the Deployment Server's app. What happens to the app If the check-sum values do not match?

Question37: A customer wants to mask unstructured data before sending it to Splunk Cloud. Where should SEBCMD be configured for this?

Question38: Which of the following is true when integrating LDAP authentication?