New Year Goodies - 55% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: av5rz84q

Exact2Pass Menu

Question # 4

How is a remote monitor input distributed to forwarders?

A.

As an app.

B.

As a forward.conf file.

C.

As a monitor.conf file.

D.

As a forwarder monitor profile.

Full Access
Question # 5

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as

follows: 123-44-5678.

Which configuration file and stanza pair will mask possible SSNs in the log events?

A.

props.conf

[mask-SSN]

REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"

FORMAT = $1###-##-$2

KEY = _raw

B.

props.conf

[mask-SSN]

REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"

FORMAT = $1###-##-$2

DEST_KEY = _raw

C.

transforms.conf

[mask-SSN]

REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"

FORMAT = $1###-##-$2

DEST_KEY = _raw

D.

transforms.conf

[mask-SSN]

REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"

FORMAT = $1###-##-$2

DEST_KEY = _raw

Full Access
Question # 6

Which forwarder type can parse data prior to forwarding?

A.

Universal forwarder

B.

Heaviest forwarder

C.

Hyper forwarder

D.

Heavy forwarder

Full Access
Question # 7

Which of the following configuration files are used with a universal forwarder? (Choose all that apply.)

A.

inputs.conf

B.

monitor.conf

C.

outputs.conf

D.

forwarder.conf

Full Access
Question # 8

Which of the following statements apply to directory inputs? {select all that apply)

A.

All discovered text files are consumed.

B.

Compressed files are ignored by default

C.

Splunk recursively traverses through the directory structure.

D.

When adding new log files to a monitored directory, the forwarder must be restarted to take them into account.

Full Access
Question # 9

Using the CLI on the forwarder, how could the current forwarder to indexer configuration be viewed?

A.

splunk btool server list --debug

B.

splunk list forward-indexer

C.

splunk list forward-server

D.

splunk btool indexes list --debug

Full Access
Question # 10

Which of the following types of data count against the license daily quota?

A.

Replicated data

B.

splunkd logs

C.

Summary index data

D.

Windows internal logs

Full Access
Question # 11

How is data handled by Splunk during the input phase of the data ingestion process?

A.

Data is treated as streams.

B.

Data is broken up into events.

C.

Data is initially written to disk.

D.

Data is measured by the license meter.

Full Access
Question # 12

Which is a valid stanza for a network input?

A.

[udp://172.16.10.1:9997]

connection = dns

sourcetype = dns

B.

[any://172.16.10.1:10001]

connection_host = ip

sourcetype = web

C.

[tcp://172.16.10.1:9997]

connection_host = web

sourcetype = web

D.

[tcp://172.16.10.1:10001]

connection_host = dns

sourcetype = dns

Full Access
Question # 13

What type of data is counted against the Enterprise license at a fixed 150 bytes per event?

A.

License data

B.

Metricsdata

C.

Internal Splunk data

D.

Internal Windows logs

Full Access
Question # 14

After how many warnings within a rolling 30-day period will a license violation occur with an enforced

Enterprise license?

A.

1

B.

3

C.

4

D.

5

Full Access
Question # 15

Which configuration file would be used to forward the Splunk internal logs from a search head to the indexer?

A.

props.conf

B.

inputs.conf

C.

outputs.conf

D.

collections.conf

Full Access
Question # 16

Consider a company with a Splunk distributed environment in production. The Compliance Department wants to start using Splunk; however, they want to ensure that no one can see their reports or any other knowledge objects. Which Splunk Component can be added to implement this policy for the new team?

A.

Indexer

B.

Deployment server

C.

Universal forwarder

D.

Search head

Full Access
Question # 17

When does a warm bucket roll over to a cold bucket?

A.

When Splunk is restarted.

B.

When the maximum warm bucket age has been reached.

C.

When the maximum warm bucket size has been reached.

D.

When the maximum number of warm buckets is reached.

Full Access
Question # 18

A log file contains 193 days worth of timestamped events. Which monitor stanza would be used to collect data 45 days old and newer from that log file?

A.

followTail = -45d

B.

ignore = 45d

C.

includeNewerThan = -35d

D.

ignoreOlderThan = 45d

Full Access
Question # 19

Which setting in indexes. conf allows data retention to be controlled by time?

A.

maxDaysToKeep

B.

moveToFrozenAfter

C.

maxDataRetentionTime

D.

frozenTimePeriodlnSecs

Full Access
Question # 20

In which phase do indexed extractions in props.conf occur?

A.

Inputs phase

B.

Parsing phase

C.

Indexing phase

D.

Searching phase

Full Access