Deck 4: Splunk Enterprise Certified Architect

Question 1

Suppose the following query in a Simple XML dashboard returns a table including hyperlinks:       index news sourcetype web_proxy | table sourcetype title link        Which of the following is a valid dynamic drilldown element to allow a user of the dashboard to visit the hyperlinks contained in the link field?

A) $row.link$
B)    $$row.link$$
C)    $row.link|n$
D)    http://localhost:8000/debug/refresh

Answer 1

A

Question 2

Which Splunk REST endpoint is used to create a KV store collection?

A) /storage/collections
B) /storage/kvstore/create
C) /storage/collections/config
D) /storage/kvstore/collections

Answer 2

A

Question 3

Which of the following is true of a namespace?

A) The namespace is a type of token filter.
B) The namespace includes an app attribute which cannot be a wildcard.
C) The namespace filters the knowledge objects returned by the REST API.
D) The namespace does not filter knowledge objects returned by the REST API.

Answer 3

D

Question 4

A KV store collection can be associated with a namespace for which of the following users?

A) Nobody
B) Users in the admin role.
C) Users in the admin and power roles.
D) Users in the admin, power, and splunk-system-user roles.

Question 5

Which type of command is tstats ?

A) Generating
B) Transforming
C) Centralized streaming
D) Distributable streaming

Question 6

When output_mode is not used, which element of a feed is a human readable name for a returned entry?

A) Author
B) Title
C) Link
D) Id

Question 7

How can indexer acknowledgement be enabled for HTTP Event Collector (HEC)? (Select all that apply.)

A) No need to do anything, it is turned on by default.
B) When a REST request is sent to create a token, the property for indexer acknowledgement must be set to 1.
C) When a new HEC token is created in Splunk Web, select the checkbox labeled "Enable indexer acknowledgement".
D) When the Global Settings for HEC are updated in Splunk Web, select the checkbox labeled "Enable indexer acknowledgement".

Question 8

Which of the following are types of event handlers? (Select all that apply.)

A) Search
B) Set token
C) Form input
D) Visualization

Question 9

Using Splunk Web to modify config settings for a shared object, a revised file with those changes is placed in which directory?

A) $SPLUNK_HOME/etc/apps/myApp/local
B) $SPLUNK_HOME/etc/system/default/
C) $SPLUNK_HOME/etc/system/local
D) $SPLUNK_HOME/etc/apps/myApp/default

Question 10

Which of the following are ways to get a list of search jobs? (Select all that apply.)

A) Access Activity > Jobs with Splunk Web. Access Activity > Jobs with Splunk Web.
B) Use Splunk REST to query the /services/search/jobs endpoint. Use Splunk REST to query the /services/search/jobs endpoint.
C) Use Splunk REST to query the /services/saved/searches endpoint. /services/saved/searches
D) Use Splunk REST to query the /services/search/sid/results endpoint. /services/search/sid/results

Question 11

Assuming permissions are set appropriately, which REST endpoint path can be used by someone with a power user role to access information about mySearch, a saved search owned by someone with a user role?

A) /servicesNS/-/data/saved/searches/mySearch
B) /servicesNS/object/saved/searches/mySearch
C) /servicesNS/search/saved/searches/mySearch
D) /servicesNS/-/search/saved/searches/mySearch

Question 12

When added to an app's default.meta file, which of the following makes one of its views available to other apps?

A) export = app
B) export = none
C) export = view
D) export = system

Question 13

Given the following two files defining app navigation, which navigation options will be displayed to the end user? (Select all that apply.) $SPLUNK_HOME/etc/apps/app_name/default/data/ui/nav/default.xml

           

$SPLUNK_HOME/etc/apps/app_name/local/data/ui/nav/default/xml

A) Search
B) Reports
C) Datasets
D) Dashboards

Question 14

In order to successfully accelerate a report, which criteria must the search meet? (Select all that apply.)

A) Cannot use event sampling.
B) Use a transforming command.
C) Use a standard Splunk visualization.
D) Commands before the first transforming command must be streamable.

Question 15

Which statements are true regarding HEC (HTTP Event Collector) tokens? (Select all that apply.)

A) Multiple tokens can be created for use with different sourcetypes and indexes.
B) The edit token http admin role capability is required to create a token. The edit token http admin role capability is required to create a token.
C) To create a token, send a POST request to services/collector endpoint. To create a token, send a POST request to services/collector endpoint.
D) Tokens can be edited using the data/inputs/http/{tokenName} endpoint. Tokens can be edited using the data/inputs/http/{tokenName}

Question 16

Which of the following is an example of a valid syntax for specifying an absolute time range modifier in a search?

A) earliest=01/01/2019:00:00:00
B) earliest=01/01/2019T00:00:00
C) earliest=2019-01-01 00:00:00
D) earliest=2019-01-01T00:00:00

Question 17

Which of the following is an example of a Splunk KV store use case? (Select all that apply.)

A) Stores checkpoint data for modular inputs.
B) Tracks workflow in an incident-review system.
C) Indexes metrics data from remote HTTP sources.
D) Stores application state as a user interacts with an app.

Question 18

How can hiding or showing a panel by clicking on a chart or a table on the same form be performed?

A) By using vent drilldown.
B) By using workflow action.
C) By using contextual drilldown.
D) By using visualization drilldown.

Question 19

There is a global search named "global_search" defined on a form as shown below:       index-_internal source-*splunkd.log | stats count by component, log_level    Which of the following would be a valid post-processing search? (Select all that apply.)

A) | tstats count
B) sourcetype=mysourcetype
C) stats sum(count) AS count by log level
D) search log_level=error | stats sum(count) AS count by component

Question 20

Which of the following describes a Splunk custom visualization?

A) A visualization with custom colors.
B) Any visualization available in Splunk.
C) A visualization in Splunk modified by the user.
D) A visualization that uses the Splunk Custom Visualization API.

Question 21

Which of the following endpoints is used to authenticate with the Splunk REST API?

A) /services/auth/login
B) /services/session/login
C) /services/auth/session/login
D) /servicesNS/authentication/login

Question 22

Log files related to Splunk REST calls can be found in which indexes? (Select all that apply.)

A) _audit
B) _internal
C) _thefishbucket
D) _blocksignature

Question 23

Which of the following are requirements for arguments sent to the data/indexes endpoint? (Select all that apply.)

A) Be url-encoded.
B) Specify the datatype.
C) Include the bucket path.
D) Include the name argument. Include the name argument.

Question 24

Which of the following is a security best practice?

A) Enable XSS.
B) Eliminate all escape characters.
C) Ensure the app passes App Certification.
D) Ensure components have no Common Vulnerabilities and Exposures (CVE) vulnerabilities.

Question 25

Which of the following Simple XML elements configure panel link buttons? (Select all that apply.)

A)
B) true
C) false
D) false

Question 26

Place content to set on page load inside which of the following Simple XML tags?

A)
B)
C)
D)

Question 27

The response message from a successful Splunk REST call includes an element. What is contained in an element?

A) A dictionary of elements. A dictionary of elements.
B) Metadata encapsulating the element. Metadata encapsulating the element.
C) A response code indicating success or failure.
D) An individual element in an collection. An individual element in an collection.

Question 28

A fellow Splunk administrator is reviewing an app that has been downloaded from splunkbase and deployed in an organization. The admin has e-mailed the following configuration snippet with a brief note that says "fix the permissions". In what configuration file should the snippet be placed? [] access = read : [ * ], write : [ admin ] export - system (Assume that $APP_HOME refers to the path that the app is installed, e.g. $SPLUNK_HOME/etc/apps/ )

A) $APP_HOME/default/app.conf
B) $APP_HOME/local/default.meta
C) $APP_HOME/metadata/local.meta
D) $SPLUNK_HOME/etc/system/local/server.conf

Question 29

What predefined drilldown tokens are available specifically for trellis layouts? (Select all that apply.)

A) trellis.Xaxis
B) trellis.Yaxis
C) trellis.name
D) trellis.value

Question 30

When the search/jobs REST endpoint is called to execute a search, what can be done to reduce the results size in the results? (Select all that apply.)

A) Use a generating search.
B) Remove unneeded fields.
C) Truncate the data, using selective functions.
D) Summarize data, using analytic commands.

Question 31

Which of the following are reserved field names in a KV Store? (Select all that apply.)

A) _key
B) _time
C) _user
D) _source

Question 32

Which of the following ensures that quotation marks surround the value referenced by the token?

A) $token_name|s$
B) "$token_name$"
C) ($token_name$)
D) \"$token_name$\"

Question 33

How can event logs be collected from a remote Windows machine using a standard Splunk installation and no customization? (Select all that apply.)

A) By configuring a WMI input.
B) By using HTTP event collector.
C) By using a Windows heavy forwarder.
D) By using a Windows universal forwarder.

Question 34

Which event handler uses the element to support pan and zoom functionality?

A) Visualization event handler
B) Form input event handler
C) Condition event handler
D) Search event handler

Question 35

Searching "index=_internal metrics | head 3" from Splunk Web returned the following events: 04-12-2018 18:39:43.514 +0200 INFO Metrics - group=thruput, name=thruput, instantaneous_kbps=0.9651774014563425, instantaneous_eps=5.645638802094809, average_kbps=1.198995639527069, total_k_processed=2676, kb=29.91796875, ev=175, load_average=3.85888671875 04-12-2018 18:39:43.514 +0200 INFO Metrics - group_thruput, name_syslog_output, instantaneous_kbps=0, instantaneous_eps_0, average_kbps=0, total_k_processed=0, kb=0, ev=0 04-12-2018 18:39:43.513 +0200 INFO Metrics - group_thruput, name_index_thruput, instantaneous_kbps=0.9651773703189551, instantaneous_eps=4.87137960922438, average_kbps=1.1985932324065556, total_k_processed=2675, kb=29.91796875, ev=151 When the same search is required from a REST API call, which fields will be given? (Select all that apply.)

A) _raw
B) name
C) sourcetype
D) instantaneous_kbps

Question 36

Which of the following search commands can be used to perform statistical queries on indexed fields in TSIDX files?

A) stats
B) tstats
C) tscollect
D) transaction

Question 37

In a DELETE request, what would omitting the value of _key from the REST endpoint do?

A) Clean the KV store, deleting all content.
B) Produce the syntax error "Key value missing" . Produce the syntax error "Key value missing" .
C) Cause all records in a collection to be deleted.
D) Mean that the _key value must be passed as an argument. Mean that the value must be passed as an argument.

Question 38

Which of the following are valid parent elements for the event action shown below? (Select all that apply.) sourcetype=$click.value|s$

A)
B)
C)     
D)

Question 39

Which items below are configured in inputs.conf ? (Select all that apply.)

A) A modular input written in Python.
B) A file input monitoring a JSON file.
C) A custom search command written in Python.
D) An HTTP Event Collector as receiver of data from an app.

Question 40

Which of the following are security best practices for Splunk app development? (Select all that apply.)

A) Store passwords in clear text in .conf files. Store passwords in clear text in .conf files.
B) Implement security in software development lifecycle.
C) Manually test application with the controls listed in the OWASP Security Testing Guide.
D) Use a dynamic scanner such as OWASP ZAP to scan web application components for vulnerabilities.

Question 41

Which of the following will unset a token named my_token ?

A) $my_token$
B)
C) false
D) disabled

Question 42

Data can be added to a KV store collection in which of the following format(s)?

A) JSON
B) JSON, XML
C) JSON, XML, CSV
D) JSON, XML, CSV, TXT