EMT Practice Test

1. Question Content...

---

Question1: Assuming permissions are set appropriately, which REST endpoint path can be used by someone with a power user role to access information about mySearch, a saved search owned by someone with a user role?

Question2: Which of the following is an example of a valid syntax for specifying an absolute time range modifier in a search?

Question3: When the search/jobs REST endpoint is called to execute a search, what can be done to reduce the results size in the results? (Select all that apply.)

Question4: Which of the following endpoints is used to authenticate with the Splunk REST API?

Question5: Which of the following are requirements for arguments sent to the data/indexes endpoint? (Select all that apply.)

Question6: When using the Splunk Web Framework to create a global search, which is the correct post-process syntax for the base search shown below?
var searchmain = new SearchManager{{ id: "base-search",
search: "index= internal | head 10 | fields "*", preview: true,
cache: true
}};

Question7: Which type of command is tstats?

Question8: Which of the following ensures that quotation marks surround the value referenced by the token?

Question9: Which of the following describes a Splunk custom visualization?

Question10: Which of the following is an example of a Splunk KV store use case? (Select all that apply.)

Question11: Which items below are configured in inputs.conf? (Select all that apply.)

Question12: Which HTTP Event Collector (HEC) endpoint should be used to collect data in the following format?
{"message":"Hello World", "foo":"bar", "pony":"buttercup"}

Question13: Which Splunk REST endpoint is used to create a KV store collection?

Question14: How can event logs be collected from a remote Windows machine using a standard Splunk installation and no customization? (Select all that apply.)

Question15: Consider the following Python code snippet used in a Splunk add-on:
if not os.path.exists(full_path): self.doAction(full_path, header) else: f = open (full_path) oldORnew = f.readline().split(",") f.close() An attacker could create a denial of service by causing an error in either the open() or readline() commands. What type of vulnerability is this?

Question16: Using Splunk Web to modify config settings for a shared object, a revised config file with those changes is placed in which directory?

Question17: Which of the following is a customization option for the Open in Search panel link button?

Question18: What predefined drilldown tokens are available specifically for trellis layouts? (Select all that apply.)

Question19: What application security best practices should be adhered to while developing an app for Splunk? (Select all that apply.)

Question20: Which of the following are security best practices for Splunk app development? (Select all that apply.)

Question21: Which statements are true regarding HEC (HTTP Event Collector) tokens? (Select all that apply.)

Question22: Which of the following is a way to monitor app performance? (Select all that apply.)

Question23: In order to successfully accelerate a report, which criteria must the search meet? (Select all that apply.)

Question24: A dashboard is taking too long to load. Several searches start with the same SPL. How can the searches be optimized in this dashboard? (Select all that apply.)

Question25: Data can be added to a KV store collection in which of the following format(s)?

Question26: A fellow Splunk administrator is reviewing an app that has been downloaded from splunkbase and deployed in an organization. The admin has e-mailed the following configuration snippet with a brief note that says "fix the permissions".
In what configuration file should the snippet be placed?
[]
access = read : [ * ], write : [ admin ] export - system
(Assume that $APP_HOME refers to the path that the app is installed, e.g. $SPLUNK_HOME/etc/apps/<app name>)

Question27: What must be done when calling the service NS endpoint?

Question28: Given a dashboard with a Simple XML extension in myApp, what is the XML reference for the file myJS.js located in myOtherApp in the location shown below?
$SPLUNK_HOME/etc/apps/myOtherApp/appserver/static/javascript/

Question29: Which of the following is true of a namespace?

Question30: A KV store collection can be associated with a namespace for which of the following users?

Question31: Which of the following Simple XML elements configure panel link buttons? (Select all that apply.)