SPLK-1003 Online Practice Questions and Answers

Correct Answer: AD

A role in Splunk is a classification that determines what capabilities and indexes a user has.A capability is a permission to perform a specific action or access a specific feature on the Splunk platform1.An index is a collection of data that Splunk software processes and stores2. By assigning roles to users, you can control what they can do and what data they can access on the Splunk platform. Therefore, the correct answers are A and D. A role in Splunk determines what capabilities and indexes a user has. Option B is incorrect because Splunk servers do not use roles to remotely control each other.Option C is incorrect because Splunk servers use instances and components to determine what functions they control3. References:1:Define roles on the Splunk platform with capabilities - Splunk Documentation2:About indexes and indexers - Splunk Documentation3:Splunk Enterprise components - Splunk Documentation

Correct Answer: AB

According to the Splunk system admin course PDF, When adding native users, Username and Password ARE REQUIRED

Correct Answer: D

Correct Answer: B

https://docs.splunk.com/Documentation/Splunk/8.0.6/Security/ManageSplunkuserroleswith LDAP

Correct Answer: A

https://www.splunk.com/en_us/blog/tips-and-tricks/what-is-this-fishbucket- thing.html "Every Splunk instance has a fishbucket index, except the lightest of hand-tuned lightweight forwarders, and if you index a lot of files it can get quite large. As any other index, you can change the retention policy to control the size via indexes.conf"

Reference https://community.splunk.com/t5/Archive/How-to-reindex-data-from-a- forwarder/td-p/93310

Correct Answer: D

Correct Answer: B

A bucket is the object that stores events inside of an index. According to the Splunk documentation, "An index is a collection of directories, also called buckets, that contain index files. Each bucket represents a specific time range." A bucket can be in one of several states, such as hot, warm, cold, frozen, or thawed. Buckets are managed by indexers or clusters of indexers.

Correct Answer: D

When there are conflicting settings within two or more configuration files, the setting with the highest precedence is used. The precedence of configuration files is determined by a combination of the file type, the directory location, and the alphabetical order of the file names.

Correct Answer: A

https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/Whitelistorblacklistspecificincomi ngdata "It is not necessary to define both an allow list and a deny list in a configuration stanza. The settings are independent. If you do define both filters and a file matches them both, Splunk Enterprise does not index that file, as the blacklist filter overrides the whitelist filter." Source:https://docs.splunk.com/Documentation/Splunk/8.1.0/Data/Whitelistorblacklistspecif icincomingdata

Correct Answer: D

https://docs.splunk.com/Documentation/Splunk/8.2.2/Updating/Aboutdeploymentserver "The deployment server is the tool for distributing configurations, apps, and content updates to groups of Splunk Enterprise instances."