SPLK-1003試験無料問題集（232題）「Splunk Enterprise Certified Admin 認定」

出題：1

A configuration file in a deployed app needs to be directly edited. Which steps would ensure a successful deployment to clients?

A. Make the change in $SPLUNK HOME/etc/dep10yment apps/$appName/10ca1/ on the deployment server, and then run $SPLUNK HOME/bin/sp1unk reload deploy--server.

B. Make the change in $SPLUNK HOME/etc/dep10yment apps/$appName/10ca1/ on the deployment server, and the change will be automatically sent to the deployment clients.

C. Make the change in $SPLUNK HOME /etc/apps/$appname/local/ on any of the deployment clients, and then run the command . / splunk reload deploy-server to push that change to the deployment server.

D. Make the change in $SPLUNK HOME/etc/apps/$appName/defau1t on the deployment server, and it will be distributed down to the clients' own local versions.

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：2

The priority of layered Splunk configuration files depends on the file's:

A. Owner

B. Context

C. Creation time

D. Weight

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：3

Which default Splunk role could be assigned to provide users with the following capabilities?
Create saved searches
Edit shared objects and alerts
Not allowed to create custom roles

A. user

B. power

C. splunk-system-role

D. admin

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：4

Which of the following authentication types requires scripting in Splunk?

A. RADIUS

B. LDAP

C. ADFS

D. SAML

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：5

Which setting in indexes.confallows data retention to be controlled by time?

A. maxDaysToKeep

B. frozenTimePeriodlnSecs

C. maxDataRetentionTime

D. moveToFrozenAfter

正解：B 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：6

What is a role in Splunk? (select all that apply)

A. A classification that determines what indexes a user can search.

B. A classification that determines if a Splunk server can remotely control another Splunk server.

C. A classification that determines what functions a Splunk server controls.

D. A classification that determines what capabilities a user has.

正解：A,D 解答を投票する

出題：7

A Universal Forwarder is collecting two separate sources of data (A,B). Source A is being routed through a Heavy Forwarder and then to an indexer. Source B is being routed directly to the indexer. Both sets of data require the masking of raw text strings before being written to disk.
What does the administrator need to do to ensure that the masking takes place successfully?

A. Make sure that props . conf and transforms . conf are both present on the in-dexer and the search head.

B. Make sure that props . conf and transforms . conf are both present on the Universal Forwarder.

C. For source A, make sure that props . conf is in place on the indexer; and for source B, make sure transforms . conf is present on the Heavy Forwarder.

D. Place both props . conf and transforms . conf on the Heavy Forwarder for source A, and place both props . conf and transforms . conf on the indexer for source B.

正解：D 解答を投票する

出題：8

How is data handled by Splunk during the input phase of the data ingestion process?

A. Data is treated as streams.

B. Data is broken up into events.

C. Data is measured by the license meter.

D. Data is initially written to disk.

正解：A 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：9

Where are forwarder apps and add-ons stored?

A. SPLUNK_HOME/system/apps/local

B. SPLUNK_HOME/etc/local

C. SPLUNK_HOME/etc/apps

D. SPLUNK_HOME/etc/system/apps

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

出題：10

After how many warnings within a rolling 30-day period will a license violation occur with an enforced Enterprise license?

A. 1

B. 4

C. 5

D. 3

正解：C 解答を投票する

解説: (GoShiken メンバーにのみ表示されます)

SPLK-1003試験無料問題集「Splunk Enterprise Certified Admin 認定」