EMT Practice Test

1. Question Content...

---

Question1: In which phase of the Splunk Enterprise data pipeline are indexed extraction configurations processed?

Question2: A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?

Question3: When Splunk indexes data in a non clustered environment, what kind of files does it create by default?

Question4: Which of the following are client filters available in serverclass.conf? (Select all that apply.)

Question5: Which Splunk tool offers a health check for administrators to evaluate the health of their Splunk deployment?

Question6: When should multiple search pipelines be enabled?

Question7: Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?

Question8: When Splunk is installed, where are the internal indexes stored by default?

Question9: What is the minimum reference server specification for a Splunk indexer?

Question10: Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

Question11: Which Splunk Enterprise offering has its own license?

Question12: Which of the following is a good practice for a search head cluster deployer?

Question13: Which of the following clarification steps should be taken if apps are not appearing on a deployment client?
(Select all that apply.)

Question14: What is the logical first step when starting a deployment plan?

Question15: A search head has successfully joined a single site indexer cluster. Which command is used to configure the same search head to join another indexer cluster?

Question16: A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

Question17: To improve Splunk performance, parallelIngestionPipelines setting can be adjusted on which of the following components in the Splunk architecture? (Select all that apply.)

Question18: In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?

Question19: Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the
_introspection index. Which of the following logs are included in this index? (Select all that apply.)

Question20: Which of the following should be included in a deployment plan?

Question21: How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?

Question22: Configurations from the deployer are merged into which location on the search head cluster member?

Question23: Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

Question24: When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

Question25: Which of the following options can improve reliability of syslog delivery to Splunk? (Select all that apply.)

Question26: When planning a search head cluster, which of the following is true?

Question27: In a distributed environment, knowledge object bundles are replicated from the search head to which location on the search peer(s)?

Question28: Which two sections can be expanded using the Search Job Inspector?

Question29: Which command will permanently decommission a peer node operating in an indexer cluster?

Question30: Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

Question31: Which component in the splunkd.log will log information related to bad event breaking?

Question32: Which Splunk internal index contains license-related events?