Free Splunk Cloud Certified Admin Exam SPLK-1005 Exam Practice Test

In which of the following situations should Splunk Support be contacted?

• When a custom search needs tuning due to not performing as expected.
• When an app on Splunkbase indicates Request Install.
• Before using the delete command.
• When a new role that mirrors sc_admin is required.

Which of the following is true when using Intermediate Forwarders?

• Intermediate Forwarders may be a mix of Universal and Heavy Forwarders.
• All Intermediate Forwarders must be Heavy Forwarders.
• Intermediate Forwarders may be Universal Forwarders or Heavy Forwarders, but may not be mixed.
• All Intermediate Forwarders must be Universal Forwarders.

A Splunk Cloud administrator is looking to allow a new group of Splunk users in the marketing department to access the Splunk environment and view a dashboard with relevant data. These users need to access marketing data (stored in the marketing_data index), but shouldn't be able to access other data, such as events related to security or operations.Which approach would be the best way to accomplish these requirements?

• Create a new user with access to the marketing_data index assigned.
• Create a new role that inherits the user role and remove the capability to search indexes other than marketing_data.
• Create a new role that inherits the admin rote and assign access to the marketing_dat.a index.
• Create a new role that does not inherit from any other role, turn on the same capabilities as the user role, and assign access to the marketing_data index.

Which statement is true about monitor inputs?

• Monitor inputs are configured in the monitor, conf file.
• The ignoreOlderThan option allows files to be ignored based on the file modification time.
• The crSalt setting is required.
• Monitor inputs can ignore a file's existing content, indexing new data as it arrives, by configuring the tailProcessor option.

What can be used in a Splunk Cloud environment to create new sourcetypes?

• Data Preview
• props. conf can be edited directly from the GUI
• Splunk's CLI
• Deployment Server

Which file or folder below is not a required part of a deployment app?

• app.conf (in default or local)
• local.meta
• metadata folder
• props.conf

When is data deleted from a Splunk Cloud index?

• When buckets roll to frozen, without a defined archive.
• When data is deleted via the Splunk Cloud Admin GUI.
• When TA_Delete is downloaded and enabled from SplunkBase.
• When the daleteindex command is executed from the CLI.

When adding a directory monitor and specifying a sourcetype explicitly, it applies to all files in the directory and subdirectories. If automatic sourcetyping is used, a user can selectively override it in which file on the forwarder?

• transforms.conf
• props.conf
• inputs.conf
• outputs.cont

Which of the following lists all parameters supported by the acceptFrom argument?

• IPv4, IPv6, CIDRs, DNS names, Wildcards
• IPv4, IPv6, CIDRs, DNS names
• CIDRs, DNS names, Wildcards
• IPv4. CIDRs, DNS names. Wildcards

What is a private app?

• An app where only a specific role has read and write access.
• An app that is only viewable by a specific user.
• An app that is created and used only by a specific organization.
• An app where only a specific role has read access.