Deck 3: Splunk Certified Developer

Question 1

What is required when adding a native user to Splunk? (Choose all that apply.)

A) Password
B) Username
C) Full Name
D) Default app

Answer 1

C,D

Question 2

How does the Monitoring Console monitor forwarders?

A) By pulling internal logs from forwarders.
B) By using the forwarder monitoring add-on.
C) With internal logs forwarded by forwarders.
D) With internal logs forwarded by deployment server.

Answer 2

A

Question 3

Which Splunk component requires a Forwarder license?

A) Search head
B) Heavy forwarder
C) Heaviest forwarder
D) Universal forwarder

Answer 3

B

Question 4

Which of the following are supported configuration methods to add inputs on a forwarder? (Choose all that apply.)

A) CLI
B) Edit inputs.conf Edit inputs.conf
C) Edit forwarder.conf forwarder.conf
D) Forwarder Management

Question 5

To set up a network input in Splunk, what needs to be specified?

A) File path.
B) Username and password.
C) Network protocol and port number.
D) Network protocol and MAC address.

Question 6

Which layers are involved in Splunk configuration file layering? (Choose all that apply.)

A) App context
B) User context
C) Global context
D) Forwarder context

Question 7

The universal forwarder has which capabilities when sending data? (Choose all that apply.)

A) Sending alerts
B) Compressing data
C) Obfuscating/hiding data
D) Indexer acknowledgement

Question 8

What is the default character encoding used by Splunk during the input phase?

A) UTF-8
B) UTF-16
C) EBCDIC
D) ISO 8859

Question 9

Which Splunk component does a search head primarily communicate with?

A) Indexer
B) Forwarder
C) Cluster master
D) Deployment server

Question 10

Which of the following is a valid distributed search group?

A) [distributedSearch:Paris] default = false servers = server1, server2
B) [ searchGroup:Paris] servers = server1:8089, server2:8089 [ searchGroup:Paris]
C) [searchGroup:Paris] servers = server1:9997, server2:9997
D) servers = server1:8089; server2:8089

Question 11

Which of the following are supported options when configuring optional network inputs?

A) Metadata override, sender filtering options, network input queues (quantum queues)
B) Metadata override, sender filtering options, network input queues (memory/persistent queues)
C) Filename override, sender filtering options, network output queues (memory/persistent queues)
D) Metadata override, receiver filtering options, network input queues (memory/persistent queues)

Question 12

Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

A) Deployer
B) Cluster master
C) Deployment server
D) Search head cluster master

Question 13

What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

A) License data
B) Metrics data
C) Internal Splunk data
D) Internal Windows logs

Question 14

In which Splunk configuration is the SEDCMD used?

A) props.conf
B) inputs.conf
C) indexes.conf
D) transforms.conf

Question 15

What options are available when creating custom roles? (Choose all that apply.)

A) Restrict search terms.
B) Whitelist search terms.
C) Limit the number of concurrent search jobs.
D) Allow or restrict indexes that can be searched.

Question 16

In case of a conflict between a whitelist and a blacklist input setting, which one is used?

A) Blacklist
B) Whitelist
C) They cancel each other out.
D) Whichever is entered into the configuration first.

Question 17

For single line event sourcetypes, it is most efficient to set SHOULD_LINEMERGE to what value?

A) true
B) false
C)
D) Newline Character

Question 18

When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

A) Slash notation
B) Regular expression
C) Irregular expression
D) Wildcard-only expression

Question 19

In which phase of the index time process does the license metering occur?

A) Input phase
B) Parsing phase
C) Indexing phase
D) Licensing phase

Question 20

Which option accurately describes the purpose of the HTTP Event Collector (HEC)?

A) A token-based HTTP input that is secure and scalable and that requires the use of forwarders.
B) A token-based HTTP input that is secure and scalable and that does not require the use of forwarders.
C) An agent-based HTTP input that is secure and scalable and that does not require the use of forwarders.
D) A token-based HTTP input that is insecure and non-scalable and that does not require the use of forwarders.

Question 21

Which valid bucket types are searchable? (Choose all that apply.)

A) Hot buckets
B) Cold buckets
C) Warm buckets
D) Frozen buckets

Question 22

What conf file needs to be edited to set up distributed search groups?

A) props.conf
B) search.conf
C) distsearch.conf
D) distibutedsearch.conf

Question 23

With authentication methods are natively supported within Splunk Enterprise? (Choose all that apply.)

A) LDAP
B) SAML
C) RADIUS
D) Duo Multifactor Authentication

Question 24

On the deployment server, administrators can map clients to server classes using client filters. Which of the following statements is accurate?

A) The blacklist takes precedence over the whitelist.
B) The whitelist takes precedence over the blacklist.
C) Wildcards are not supported in any client filters.
D) Machine type filters are applied before the whitelist and blacklist.

Question 25

Which of the following are required when defining an index in indexes.conf ? (Choose all that apply.)

A) coldPath
B) homePath
C) frozenPath
D) thawedPath

Question 26

Which of the following apply to how distributed search works? (Choose all that apply.)

A) The search head dispatches searches to the peers.
B) The search peers pull the data from the forwarders.
C) Peers run searches in parallel and return their portion of results.
D) The search head consolidates the individual results and prepares reports.

Question 27

Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?

A) Any OS platform.
B) Linux platform only.
C) Windows platform only.
D) None of the above.

Question 28

Which Splunk component performs indexing and responds to search requests from the search head?

A) Forwarder
B) Search peer
C) License master
D) Search head cluster

Question 29

The volume of data from collecting log files from 50 Linux servers and 200 Windows servers will require multiple indexers. Following best practices, which types of Splunk component instances are needed?

A) Indexers, search head, universal forwarders, license master
B) Indexers, search head, deployment server, universal forwarders
C) Indexers, search head, deployment server, license master, universal forwarder
D) Indexers, search head, deployment server, license master, universal forwarder, heavy forwarder

Question 30

What are the required stanza attributes when configuring the transforms.conf to manipulate or remove events?

A) REGEX, DEST, FORMAT
B) REGEX, SRC_KEY, FORMAT
C) REGEX, DEST_KEY, FORMAT
D) REGEX, DEST_KEY, FORMATTING

Question 31

Which of the following configuration files are used with a universal forwarder? (Choose all that apply.)

A) inputs.conf
B) monitor.conf
C) outputs.conf
D) forwarder.conf

Question 32

Where are license files stored?

A) $SPLUNK_HOME/etc/secure
B) $SPLUNK_HOME/etc/system
C) $SPLUNK_HOME/etc/licenses
D) $SPLUNK_HOME/etc/apps/licenses

Question 33

How do you remove missing forwarders from the Monitoring Console?

A) By restarting Splunk.
B) By rescanning active forwarders.
C) By reloading the deployment server.
D) By rebuilding the forwarder asset table.

Question 34

After configuring a universal forwarder to communicate with an indexer, which index can be checked via the Splunk Web UI for a successful connection?

A) index=main
B) index=test
C) index=summary
D) index=_internal

Question 35

When are knowledge bundles distributed to search peers?

A) After a user logs in.
B) When Splunk is restarted.
C) When adding a new search peer.
D) When a distributed search is initiated.

Question 36

When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

A) App Class
B) Client Class
C) Server Class
D) Forwarder Class

Question 37

How can native authentication be disabled in Splunk?

A) Remove the $SPLUNK_HOME/etc/passwd file Remove the $SPLUNK_HOME/etc/passwd file
B) Create an empty $SPLUNK_HOME/etc/passwd file Create an empty
C) Set SPLUNK_AUTHENTICATION=false in splunk-launch.conf Set SPLUNK_AUTHENTICATION=false in splunk-launch.conf
D) Set nativeAuthentication=false in authentication.conf nativeAuthentication=false authentication.conf

Question 38

Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)

A) props.conf
B) inputs.conf
C) rawdata.conf
D) transforms.conf

Question 39

If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?

A) Indexer
B) Forwarder
C) Search head
D) Deployment server

Question 40

Which is a valid stanza for a network input?

A) [udp://172.16.10.1:9997] connection = dns sourcetype = dns
B) [any://172.16.10.1:10001] connection_host = ip sourcetype = web
C) [tcp://172.16.10.1:9997] connection_host = web
D) [tcp://172.16.10.1:10001] connection_host = dns

Question 41

This file has been manually created on a universal forwarder: /opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf [monitor:///var/log/messages] sourcetype=syslog index=syslog A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file: /opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf [monitor:///var/log/maillog] sourcetype=maillog Which file is now monitored?

A) /var/log/messages
B) /var/log/maillog
C) /var/log/maillog and /var/log/messages and
D) none of the above

Question 42

The CLI command splunk add forward-server indexer: will create stanza(s) in which configuration file?

A) inputs.conf
B) indexes.conf
C) outputs.conf
D) servers.conf

Question 43

When does a warm bucket roll over to a cold bucket?

A) When Splunk is restarted.
B) When the maximum warm bucket age has been reached.
C) When the maximum warm bucket size has been reached.
D) When the maximum number of warm buckets is reached.

Question 44

What is the valid option for a [monitor] stanza in inputs.conf ?

A) enabled
B) datasource
C) server_name
D) ignoreOlderThan

Question 45

Which setting in indexes.conf allows data retention to be controlled by time?

A) maxDaysToKeep
B) moveToFrozenAfter
C) maxDataRetentionTime
D) frozenTimePeriodInSecs

Question 46

Who provides the Application Secret, Integration, and Secret keys, as well as the API Hostname when setting up Duo for Multi-Factor Authentication in Splunk Enterprise?

A) Duo Administrator
B) LDAP Administrator
C) SAML Administrator
D) Trio Administrator

Question 47

Which feature in Splunk allows Event Breaking, Timestamp extractions, and any advanced configurations found in props.conf to be validated all through the UI?

A) Apps
B) Search
C) Data preview
D) Forwarder inputs

Question 48

The Splunk administrator wants to ensure data is distributed evenly amongst the indexers. To do this, he runs the following search over the last 24 hours: index=* What field can the administrator check to see the data distribution?

A) host
B) index
C) linecount
D) splunk_server

Question 49

The universal forwarder has which capabilities when sending data? (Select all that apply.)

A) Sending alerts
B) Compressing data
C) Obfuscating/hiding data
D) Indexer acknowledgement

Question 50

How is data handled by Splunk during the input phase of the data ingestion process?

A) Data is treated as streams.
B) Data is broken up into events.
C) Data is initially written to disk.
D) Data is measured by the license meter.

Question 51

Which parent directory contains the configuration files in Splunk?

A) $SPLUNK_HOME/etc
B) $SPLUNK_HOME/var
C) $SPLUNK_HOME/conf
D) $SPLUNK_HOME/default

Question 52

An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data is 300 GB per day. To minimize license issues, what is the best way to add 10 TB of historical data to the index?

A) Buy a bigger Splunk license.
B) Add 2.5 TB each day for the next 5 days.
C) Add all 10 TB in a single 24 hour period.
D) Add 200 GB of historical data each day for 50 days.

Question 53

An organization wants to collect Windows performance data from a set of clients, however, installing Splunk software on these clients is not allowed. What option is available to collect this data in Splunk Enterprise?

A) Use Local Windows host monitoring.
B) Use Windows Remote Inputs with WMI.
C) Use Local Windows network monitoring.
D) Use an index with an Index Data Type of Metrics.

Question 54

Where are deployment server apps mapped to clients?

A) Apps tab in forwarder management interface or clientapps.conf . Apps tab in forwarder management interface or clientapps.conf .
B) Clients tab in forwarder management interface or deploymentclient.conf . Clients tab in forwarder management interface or deploymentclient.conf
C) Server Classes tab in forwarder management interface or serverclass.conf . Server Classes tab in forwarder management interface or serverclass.conf
D) Client Applications tab in forwarder management interface or clientapps.conf . Client Applications tab in forwarder management interface or

Question 55

Which of the following must be done to define user permissions when integrating Splunk with LDAP?

A) Map Users
B) Map Groups
C) Map LDAP Inheritance
D) Map LDAP to Active Directory

Question 56

After how many warnings within a rolling 30-day period will a license violation occur with an enforced Enterprise license?

A) 1
B) 3
C) 4
D) 5

Question 57

Which forwarder type can parse data prior to forwarding?

A) Universal forwarder
B) Heaviest forwarder
C) Hyper forwarder
D) Heavy forwarder

Question 58

In a distributed environment, which Splunk component is used to distribute apps and configurations to the other Splunk instances?

A) Indexer
B) Deployer
C) Forwarder
D) Deployment server

Question 59

Which of the following are supported configuration methods to add inputs on a forwarder? (Select all that apply.)

A) CLI
B) Edit inputs.conf Edit inputs.conf
C) Edit forwarder.conf forwarder.conf
D) Forwarder Management

Question 60

You update a props.conf file while Splunk is running. You do not restart Splunk and you run this command: splunk btool props list --debug . What will the output be?

A) A list of all the configurations on-disk that Splunk contains.
B) A verbose list of all configurations as they were when splunkd started.
C) A list of props.conf configurations as they are on-disk along with a file path from which the configuration is located. A list of configurations as they are on-disk along with a file path from which the configuration is located.
D) A list of the current running props.conf configurations along with a file path from which the configuration was made. A list of the current running configurations along with a file path from which the configuration was made.

Question 61

With authentication methods are natively supported within Splunk Enterprise? (Select all that apply.)

A) LDAP
B) SAML
C) RADIUS
D) Duo Multifactor Authentication

Question 62

How often does Splunk recheck the LDAP server?

A) Every 5 minutes.
B) Each time a user logs in.
C) Each time Splunk is restarted.
D) Varies based on LDAP_refresh setting.

Question 63

How does the Monitoring Console monitor forwarders?

A) By pulling internal logs from forwarders.
B) By using the forwarder monitoring add-on.
C) With internal logs forwarded by forwarders.
D) With internal logs forwarder by deployment server.

Question 64

Where should apps be located on the deployment server that the clients pull from?

A) $SPLUNK_HOME/etc/apps
B) $SPLUNK_HOME/etc/search
C) $SPLUNK_HOME/etc/master-apps
D) $SPLUNK_HOME/etc/deployment-apps

Question 65

During search time, which directory of configuration files has the highest precedence?

A) $SPLUNK_HOME/etc/system/local
B) $SPLUNK_HOME/etc/system/default
C) $SPLUNK_HOME/etc/apps/app1/local
D) $SPLUNK_HOME/etc/ users /admin/local

Question 66

What is the correct order of steps in Duo Multifactor Authentication?

A) 1. Request Login 2. Connect to SAML server 3. Duo MFA 4. Create User session 5. Authentication Granted 6. Log into Splunk
B) 2. Duo MFA 3. Authentication Granted 4. Connect to SAML server 5. Log into Splunk 6. Create User session
C) 2. Check authentication / group mapping 4. Duo MFA 5. Create User session
D) 3. Check authentication / group mapping

Question 67

Which of the following enables compression for universal forwarders in outputs.conf ?

A) [ udpout:mysplunk_indexer11] compression=true [ udpout:mysplunk_indexer11]
B) [tcpout] defaultGroup=my_indexers compressed=true
C) /opt/splunkforwarder/bin/splunk enable compression
D) [ tcpount:my_indexers] server=mysplunk_indexer1:9997, mysplunk_indexer2:9997 decompression=false tcpount:my_indexers] server=mysplunk_indexer1:9997, mysplunk_indexer2:9997

Question 68

Which of the following statements describe deployment management? (Select all that apply.)

A) Requires an Enterprise license.
B) Is responsible for sending apps to forwarders.
C) Once used, is the only way to manage forwarders.
D) Can automatically restart the host OS running the forwarder.

Question 69

Which of the following authentication types requires scripting in Splunk?

A) ADFS
B) LDAP
C) SAML
D) RADIUS

Question 70

Which optional configuration setting in inputs.conf allows you to selectively forward the data to specific indexer(s)?

A) _TCP_ROUTING
B) _INDEXER_LIST
C) _INDEXER_GROUP
D) _INDEXER_ROUTING

Question 71

What options are available when creating custom roles? (Select all that apply.)

A) Restrict search terms.
B) Whitelist search terms.
C) Limit the number of concurrent search jobs.
D) Allow or restrict indexes that can be searched.

Question 72

How would you configure your distsearch.conf to allow you to run the search below? sourcetype=access_combined status=200 action=purchase splunk_server_group=HOUSTON

A) [distributedSearch:NYC] default = false servers = nyc1:8089, nyc2:8089 [distributedSearch:HOUSTON] servers = houston1:8089, houston2:8089
B) [distributedSearch] servers =nyc1, nyc2, houston1, houston2 servers = nyc1, nyc2 servers = houston1, houston2
C) servers =nyc1:8089, nyc2:8089, houston1:8089, houston2:8089
D) servers =nyc1:8089; nyc2:8089; houston1:8089; houston2:8089 servers = nyc1:8089; nyc2:8089 servers = houston1:8089; houston2:8089

Question 73

User role inheritance allows what to be inherited from the parent role? (Select all that apply.)

A) Parents
B) Capabilities
C) Index access
D) Search history

Question 74

The priority of layered Splunk configuration files depends on the file's:

A) Owner
B) Weight
C) Context
D) Creation time

Question 75

Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

A) Indexers
B) Forwarder
C) Search head
D) Search peers

Question 76

Which of the following statements describe deployment management? (Choose all that apply.)

A) Requires an Enterprise license.
B) Is responsible for sending apps to forwarders.
C) Once used, is the only way to manage forwarders.
D) Can automatically restart the host OS running the forwarder.

Question 77

Which of the following apply to how distributed search works? (Select all that apply.)

A) The search head dispatches searches to the peers.
B) The search peers pull the data from the forwarders.
C) Peers run searches in parallel and return their portion of results.
D) The search head consolidates the individual results and prepares reports.

Question 78

What hardware attribute would you need to be changed to increase the number of simultaneous searches (ad-hoc and scheduled) on a single search head?

A) Disk
B) CPUs
C) Memory
D) Network interface cards

Question 79

Which of the following are methods for adding inputs in Splunk? (Select all that apply.)

A) CLI
B) Splunk Web
C) Editing inpits.conf Editing inpits.conf
D) Editing monitor.conf monitor.conf

Question 80

What are the minimum required settings when creating a network input in Splunk?

A) Protocol, port number
B) Protocol, port, location
C) Protocol, username, port
D) Protocol, IP, port number