Pass Your Exam With 100% Verified SPLK-1003 Exam Questions [Q10-Q24] : Latest Exam Prep : http://certify.vceprep.com

NO.10 On the deployment server, administrators can map clients to server classes using client filters. Which of the following statements is accurate?

The blacklist takes precedence over the whitelist.

The whitelist takes precedence over the blacklist.

Wildcards are not supported in any client filters.

Machine type filters are applied before the whitelist and blacklist.

NO.11 Which of the following is an appropriate description of a deployment server in a non-cluster environment?

Allows management of local Splunk instances, requires Enterprise license, handles job of sending configurations packaged as apps. can automatically restart remote Splunk instances.

Allows management of remote Splunk instances, requires Enterprise license, handles job of sending configurations, can automatically restart remote Splunk instances.

Allows management of remote Splunk instances, requires no license, handles job of sending configurations, can automatically restart remote Splunk instances.

Allows management of remote Splunk instances, requires Enterprise license, handles job of sending configurations, can manually restart remote Splunk instances.

NO.12 Which Splunk configuration file is used to enable data integrity checking?

props.conf

global.conf

indexes.conf

data_integrity.conf

NO.13 What is the correct order of steps in Duo Multifactor Authentication?

1 Request Login
2. Connect to SAML server
3 Duo MFA
4 Create User session
5 Authentication Granted 6. Log into Splunk

1. Request Login 2 Duo MFA
3. Authentication Granted 4 Connect to SAML server
5. Log into Splunk
6. Create User session

1 Request Login
2 Check authentication / group mapping
3 Authentication Granted
4. Duo MFA
5. Create User session
6. Log into Splunk

1 Request Login 2 Duo MFA
3. Check authentication / group mapping
4 Create User session
5. Authentication Granted
6 Log into Splunk

NO.14 Which Splunk indexer operating system platform is supported when sending logs from a Windows universal forwarder?

Any OS platform

Linux platform only

Windows platform only.

None of the above.

NO.15 Where are deployment server apps mapped to clients?

Apps tab in forwarder management interface or clientapps.conf.

Clients tab in forwarder management interface or deploymentclient.conf.

Server Classes tab in forwarder management interface or serverclass.conf.

Client Applications tab in forwarder management interface or clientapps.conf.

NO.16 After an Enterprise Trial license expires, it will automatically convert to a Free license. How many days is an Enterprise Trial license valid before this conversion occurs?

90 days

60 days

7 days

14 days

NO.17 Which valid bucket types are searchable? (Choose all that apply.)

Hot buckets

Cold buckets

Warm buckets

Frozen buckets

NO.18 The universal forwarder has which capabilities when sending data? (select all that apply)

Sending alerts

Compressing data

Obfuscating/hiding data

Indexer acknowledgement

NO.19 Which of the following are available input methods when adding a file input in Splunk Web? (Choose all that apply.)

Index once.

Monitor interval.

On-demand monitor.

Continuously monitor.

NO.20 What action is required to enable forwarder management in Splunk Web?

Navigate to Settings > Server Settings > General Settings, and set an App server port.

Navigate to Settings > Forwarding and receiving, and click on Enable Forwarding.

Create a server class and map it to a client in SPLUNK_HOME/etc/system/local/serverclass.conf.

Place an app in the SPLUNK_HOME/etc/deployment-apps directory of the deployment server.

NO.21 Which of the following Splunk components require a separate installation package?

Deployment server

License master

Universal forwarder

Heavy forwarder

NO.22 What options are available when creating custom roles? (select all that apply)

Restrict search terms

Whitelist search terms

Limit the number of concurrent search jobs

Allow or restrict indexes that can be searched.

NO.23 A new forwarder has been installed with a manually createddeploymentclient.conf.
What is the next step to enable the communication between the forwarder and the deployment server?

Restart Splunk on the deployment server.

Enable the deployment client in Splunk Web under Forwarder Management.

Restart Splunk on the deployment client.

Wait for up to the time set in thephoneHomeIntervalInSecssetting.

NO.24 An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data is
300 GB per day. To minimize license issues, what is the best way to add 10 TB of historical data to the index?

Buy a bigger Splunk license.

Add 2.5 TB each day for the next 5 days.

Add all 10 TB in a single 24 hour period.

Add 200 GB of historical data each day for 50 days.