EMT Practice Test

1. Question Content...

---

Question1: Which of the following is the most efficient search?

Question2: A customer has three users and is planning to ingest 250GB of data per day. They are concerned with search uptime, can tolerate up to a two-hour downtime for the search tier, and want advice on single search head versus a search head cluster. (SHC).
Which recommendation is the most appropriate?

Question3: In which of the following scenarios should base configurations be used to provide consistent, repeatable, and supportable configurations?

Question4: Monitoring Console (MC) health check configuration items are stored in which configuration file?

Question5: A customer has asked for a five-node search head cluster (SHC), but does not have the storage budget to use a replication factor greater than 2. They would like to understand what might happen in terms of the users' ability to view historic scheduled search results if they log onto a search head which doesn't contain one of the 2 copies of a given search artifact.
Which of the following statements best describes what would happen in this scenario?

Question6: A working search head cluster has been set up and used for 6 months with just the native/local Splunk user authentication method. In order to integrate the search heads with an external Active Directory server using LDAP, which of the following statements represents the most appropriate method to deploy the configuration to the servers?

Question7: Consider the scenario where the /var/log directory contains the files secure, messages, cron, audit. A customer has created the following inputs.conf stanzas in the same Splunk app in order to attempt to monitor the files secure and messages:

Which file(s) will actually be actively monitored?

Question8: A customer wants to implement LDAP because managing local Splunk users is becoming too much of an overhead. What configuration details are needed from the customer to implement LDAP authentication?

Question9: A customer has 30 indexers in an indexer cluster configuration and two search heads. They are working on writing SPL search for a particular use-case, but are concerned that it takes too long to run for short time durations.
How can the Search Job Inspector capabilities be used to help validate and understand the customer concerns?

Question10: When using SAML, where does user authentication occur?

Question11: A customer is having issues with truncated events greater than 64K. What configuration should be deployed to a universal forwarder (UF) to fix the issue?

Question12: Which configuration item should be set to false to significantly improve data ingestion performance?

Question13: A customer has a multisite cluster (two sites, each site in its own data center) and users experiencing a slow response when searches are run on search heads located in either site. The Search Job Inspector shows the delay is being caused by search heads on either site waiting for results to be returned by indexers on the opposing site. The network team has confirmed that there is limited bandwidth available between the two data centers, which are in different geographic locations.
Which of the following would be the least expensive and easiest way to improve search performance?

Question14: In preparation for the deployment of a new environment for a customer, which of the following mappings are correct per PS best practices?

Question15: Report acceleration has been enabled for a specific use case. In which bucket location is the corresponding CSV file located?

Question16: When adding a new search head to a search head cluster (SHC), which of the following scenarios occurs?

Question17: Which command is most efficient in finding the pass4SymmKey of an index cluster?

Question18: A non-ES customer has a concern about data availability during a disaster recovery event. Which of the following Splunk Validated Architectures (SVAs) would be recommended for that use case?

Question19: In which directory should base config app(s) be placed to initialize an indexer?

Question20: How could a role in which all users must specify an index=clause in all searches be configured?

Question21: Which statement is true about subsearches?

Question22: A customer has a search cluster (SHC) of six members split evenly between two data centers (DC). The customer is concerned with network connectivity between the two DCs due to frequent outages. Which of the following is true as it relates to SHC resiliency when a network outage occurs between the two DCs?

Question23: The Splunk Validated Architectures (SVAs) document provides a series of approved Splunk topologies. Which statement accurately describes how it should be used by a customer?

Question24: In a single indexer cluster, where should the Monitoring Console (MC) be installed?

Question25: A customer has a Universal Forwarder (UF) with an inputs.conf monitoring its splunkd.log. The data is sent through a heavy forwarder to an indexer.
Where does the Index time parsing occur?

Question26: Which event processing pipeline contains the regex replacement processor that would be called upon to run event masking routines on events as they are ingested?

Question27: What happens when an index cluster peer freezes a bucket?

Question28: In the diagrammed environment shown below, the customer would like the data read by the universal forwarders to set an indexed field containing the UF's host name. Where would the parsing configurations need to be installed for this to work?

Question29: Which of the following server roles should be configured for a host which indexes its internal logs locally?

Question30: A customer is migrating their existing Splunk Indexer from an old set of hardware to a new set of indexers. What is the earliest method to migrate the system?

Question31: A customer has been using Splunk for one year, utilizing a single/all-in-one instance. This single Splunk server is now struggling to cope with the daily ingest rate.
Also, Splunk has become a vital system in day-to-day operations making high availability a consideration for the Splunk service. The customer is unsure how to design the new environment topology in order to provide this.
Which resource would help the customer gather the requirements for their new architecture?

Question32: A new search head cluster is being implemented. Which is the correct command to initialize the deployer node without restarting the search head cluster peers?

Question33: As a best practice which of the following should be used to ingest data on clustered indexers?

Question34: A customer would like to remove the output_file capability from users with the default user role to stop them from filling up the disk on the search head with lookup files. What is the best way to remove this capability from users?

Question35: What happens to the indexer cluster when the indexer Cluster Master (CM) runs out of disk space?

Question36: Which of the following processor occur in the indexing pipeline?