Free Splunk Enterprise Certified Admin Exam SPLK-1003 Exam Practice Test

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is asfollows: 123-44-5678.Which configuration file and stanza pair will mask possible SSNs in the log events?

• props.conf [mask-SSN] REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$' FORMAT = $1###-##-$2 KEY = _raw
• props.conf [mask-SSN] REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$' FORMAT = $1###-##-$2 DEST_KEY = _raw
• transforms.conf [mask-SSN] REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$' FORMAT = $1###-##-$2 DEST_KEY = _raw
• transforms.conf [mask-SSN] REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$' FORMAT = $1###-##-$2 DEST_KEY = _raw

In addition to single, non-clustered Splunk instances, what else can the deployment server push apps to?

• Universal forwarders
• Splunk Cloud
• Linux package managers
• Windows using WMI

The CLI command splunk add forward-server indexer:<receiving-port> will create stanza(s) inwhich configuration file?

• inputs.conf
• indexes.conf
• outputs.conf
• servers.conf

How often does Splunk recheck the LDAP server?

• Every 5 minutes
• Each time a user logs in
• Each time Splunk is restarted
• Varies based on LDAP_refresh setting.

Which of the following describes a Splunk deployment server?

• A Splunk Forwarder that deploys data to multiple indexers.
• A Splunk app installed on a Splunk Enterprise server.
• A Splunk Enterprise server that distributes apps.
• A server that automates the deployment of Splunk Enterprise to remote servers.

Which of the following is the use case for the deployment server feature of Splunk?

• Managing distributed workloads in a Splunk environment.
• Automating upgrades of Splunk forwarder installations on endpoints.
• Orchestrating the operations and scale of a containerized Splunk deployment.
• Updating configuration and distributing apps to processing components, primarily forwarders.

Given a forwarder with the following outputs.conf configuration:[tcpout : mypartner]Server = 145.188.183.184:9097[tcpout : hfbank]server = inputsl . mysplunkhfs . corp : 9997 , inputs2 . mysplunkhfs . corp : 9997Which of the following is a true statement?

• Data will continue to flow to hfbank if 145.1 g a) 183.184 : 9097 is unreachable.
• Data is not encrypted to mypartner because 145.188 .183.184 : 9097 is specified by IP.
• Data is encrypted to mypartner because 145.183.184 : 9097 is specified by IP.
• Data will eventually stop flowing everywhere if 145.188.183.184 : 9097 is unreachable.

When configuring HTTP Event Collector (HEC) input, how would one ensure the events have been indexed?

• Enable indexer acknowledgment.
• Enable forwarder acknowledgment.
• splunk check-integrity -index
• index=_internal component=ACK | stats count by host

Immediately after installation, what will a Universal Forwarder do first?

• Automatically detect any indexers in its subnet and begin routing data.
• Begin reading local files on its server.
• Begin generating internal Splunk logs.
• Send an email to the operator that the installation process has completed.

Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)

• props.conf
• inputs.conf
• rawdata.conf
• transforms.conf