Question 1

What is required when adding a native user to Splunk? (Choose all that apply.)
A) Password
B) Username
C) Full Name
D) Default app

Accepted Answer

C,D

Question 2

How does the Monitoring Console monitor forwarders?
A) By pulling internal logs from forwarders.
B) By using the forwarder monitoring add-on.
C) With internal logs forwarded by forwarders.
D) With internal logs forwarded by deployment server.

Accepted Answer

The Monitoring Console monitors forwarders by pulling internal logs from forwarders.

Question 3

Which Splunk component requires a Forwarder license?
A) Search head
B) Heavy forwarder
C) Heaviest forwarder
D) Universal forwarder

Accepted Answer

A Heavy forwarder requires a Forwarder license to forward data to an indexer in a Splunk deployment.

Question 4

Which of the following are supported configuration methods to add inputs on a forwarder? (Choose all that apply.)
A) CLI
B) Edit inputs.conf Edit inputs.conf
C) Edit forwarder.conf forwarder.conf
D) Forwarder Management

Accepted Answer

The answer of Which of the following are supported configuration...

Question 5

To set up a network input in Splunk, what needs to be specified?
A) File path.
B) Username and password.
C) Network protocol and port number.
D) Network protocol and MAC address.

Accepted Answer

The answer of To set up a network input in...

Question 6

Which layers are involved in Splunk configuration file layering? (Choose all that apply.)
A) App context
B) User context
C) Global context
D) Forwarder context

Accepted Answer

Splunk configuration file layering involves the app context, user context, and global context, which determine how configurations are applied and prioritized.

Question 7

The universal forwarder has which capabilities when sending data? (Choose all that apply.)
A) Sending alerts
B) Compressing data
C) Obfuscating/hiding data
D) Indexer acknowledgement

Accepted Answer

The answer of The universal forwarder has which capabilities when...

Question 8

What is the default character encoding used by Splunk during the input phase?
A) UTF-8
B) UTF-16
C) EBCDIC
D) ISO 8859

Accepted Answer

Splunk uses UTF-8 as the default character encoding during the input phase.

Question 9

Which Splunk component does a search head primarily communicate with?
A) Indexer
B) Forwarder
C) Cluster master
D) Deployment server

Accepted Answer

A search head primarily communicates with the Indexer to retrieve and search data.

Question 10

Which of the following is a valid distributed search group?
A) [distributedSearch:Paris] default = false servers = server1, server2
B) [ searchGroup:Paris] servers = server1:8089, server2:8089 [ searchGroup:Paris]
C) [searchGroup:Paris] servers = server1:9997, server2:9997
D) servers = server1:8089; server2:8089

Accepted Answer

The answer of Which of the following is a valid...

Question 11

Which of the following are supported options when configuring optional network inputs?
A) Metadata override, sender filtering options, network input queues (quantum queues)
B) Metadata override, sender filtering options, network input queues (memory/persistent queues)
C) Filename override, sender filtering options, network output queues (memory/persistent queues)
D) Metadata override, receiver filtering options, network input queues (memory/persistent queues)

Accepted Answer

The answer of Which of the following are supported options...

Question 12

Which Splunk component distributes apps and certain other configuration updates to search head cluster members?
A) Deployer
B) Cluster master
C) Deployment server
D) Search head cluster master

Accepted Answer

The Deployer is responsible for distributing apps and configuration updates to search head cluster members in a Splunk environment.

Question 13

What type of data is counted against the Enterprise license at a fixed 150 bytes per event?
A) License data
B) Metrics data
C) Internal Splunk data
D) Internal Windows logs

Accepted Answer

Metrics data is counted against the Enterprise license at a fixed 150 bytes per event.

Question 14

In which Splunk configuration is the SEDCMD used?
A) props.conf
B) inputs.conf
C) indexes.conf
D) transforms.conf

Accepted Answer

SEDCMD is used in the props.conf file to perform inline search-time field extractions and transformations using regular expressions.

Question 15

What options are available when creating custom roles? (Choose all that apply.)
A) Restrict search terms.
B) Whitelist search terms.
C) Limit the number of concurrent search jobs.
D) Allow or restrict indexes that can be searched.

Accepted Answer

The answer of What options are available when creating custom...

Question 16

In case of a conflict between a whitelist and a blacklist input setting, which one is used?
A) Blacklist
B) Whitelist
C) They cancel each other out.
D) Whichever is entered into the configuration first.

Accepted Answer

In most systems, a blacklist takes precedence over a whitelist because it is used to block specific items, ensuring that potentially harmful or unwanted elements are not allowed, even if they appear on a whitelist.

Question 17

For single line event sourcetypes, it is most efficient to set SHOULD_LINEMERGE to what value?
A) true
B) false
C) <regex string>
D) Newline Character

Accepted Answer

The answer of For single line event sourcetypes, it is...

Question 18

When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?
A) Slash notation
B) Regular expression
C) Irregular expression
D) Wildcard-only expression

Accepted Answer

Regular expressions are the supported method for filtering lists when configuring monitor inputs with whitelists or blacklists.

Question 19

In which phase of the index time process does the license metering occur?
A) Input phase
B) Parsing phase
C) Indexing phase
D) Licensing phase

Accepted Answer

License metering occurs during the indexing phase, where data is processed and stored, and the amount of data indexed is measured against the license.

Question 20

Which option accurately describes the purpose of the HTTP Event Collector (HEC)?
A) A token-based HTTP input that is secure and scalable and that requires the use of forwarders.
B) A token-based HTTP input that is secure and scalable and that does not require the use of forwarders.
C) An agent-based HTTP input that is secure and scalable and that does not require the use of forwarders.
D) A token-based HTTP input that is insecure and non-scalable and that does not require the use of forwarders.

Accepted Answer

The HTTP Event Collector (HEC) is a token-based HTTP input that is secure and scalable and does not require the use of forwarders.

Exam 3: Splunk Certified Developer

What is required when adding a native user to Splunk? (Choose all that apply.)

How does the Monitoring Console monitor forwarders?

Which Splunk component requires a Forwarder license?

Which of the following are supported configuration methods to add inputs on a forwarder? (Choose all that apply.)

To set up a network input in Splunk, what needs to be specified?

Which layers are involved in Splunk configuration file layering? (Choose all that apply.)

The universal forwarder has which capabilities when sending data? (Choose all that apply.)

What is the default character encoding used by Splunk during the input phase?

Which Splunk component does a search head primarily communicate with?

Which of the following is a valid distributed search group?

Which of the following are supported options when configuring optional network inputs?

Which Splunk component distributes apps and certain other configuration updates to search head cluster members?

What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

In which Splunk configuration is the SEDCMD used?

What options are available when creating custom roles? (Choose all that apply.)

In case of a conflict between a whitelist and a blacklist input setting, which one is used?

For single line event sourcetypes, it is most efficient to set SHOULD_LINEMERGE to what value?

When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

In which phase of the index time process does the license metering occur?

Which option accurately describes the purpose of the HTTP Event Collector (HEC) ?