Question 1

How do you remove missing forwarders from the Monitoring Console?

Accepted Answer

A)  By restarting Splunk. 
B)  By rescanning active forwarders. 
C)  By reloading the deployment server. 
D)  By rebuilding the forwarder asset table.

Question 2

When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

Accepted Answer

A)  App Class 
B)  Client Class 
C)  Server Class 
D)  Forwarder Class

Question 3

What is the valid option for a [monitor] stanza in inputs.conf ?

Accepted Answer

A)  enabled 
B)  datasource 
C)  server_name 
D)  ignoreOlderThan

Question 4

Which Splunk component performs indexing and responds to search requests from the search head?

Accepted Answer

A)  Forwarder 
B)  Search peer 
C)  License master 
D)  Search head cluster

Question 5

In a distributed environment, which Splunk component is used to distribute apps and configurations to the other Splunk instances?

Accepted Answer

A)  Indexer 
B)  Deployer 
C)  Forwarder 
D)  Deployment server

Question 6

Which Splunk component requires a Forwarder license?

Accepted Answer

A)  Search head 
B)  Heavy forwarder 
C)  Heaviest forwarder 
D)  Universal forwarder

Question 7

In which Splunk configuration is the SEDCMD used?

Accepted Answer

A)  props.conf 
B)  inputs.conf 
C)  indexes.conf 
D)  transforms.conf

Question 8

An admin is running the latest version of Splunk with a 500 GB license. The current daily volume of new data is 300 GB per day. To minimize license issues, what is the best way to add 10 TB of historical data to the index?

Accepted Answer

A)  Buy a bigger Splunk license. 
B)  Add 2.5 TB each day for the next 5 days. 
C)  Add all 10 TB in a single 24 hour period. 
D)  Add 200 GB of historical data each day for 50 days.

Question 9

Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

Accepted Answer

A)  Indexers 
B)  Forwarder 
C)  Search head 
D)  Search peers

Question 10

Which of the following are supported options when configuring optional network inputs?

Accepted Answer

A)  Metadata override, sender filtering options, network input queues (quantum queues) 
B)  Metadata override, sender filtering options, network input queues (memory/persistent queues) 
C)  Filename override, sender filtering options, network output queues (memory/persistent queues) 
D)  Metadata override, receiver filtering options, network input queues (memory/persistent queues)

Question 11

An organization wants to collect Windows performance data from a set of clients, however, installing Splunk software on these clients is not allowed. What option is available to collect this data in Splunk Enterprise?

Accepted Answer

A)  Use Local Windows host monitoring. 
B)  Use Windows Remote Inputs with WMI. 
C)  Use Local Windows network monitoring. 
D)  Use an index with an Index Data Type of Metrics.

Question 12

With authentication methods are natively supported within Splunk Enterprise? (Select all that apply.)

Accepted Answer

A)  LDAP 
B)  SAML 
C)  RADIUS 
D)  Duo Multifactor Authentication

Question 13

Which of the following are supported configuration methods to add inputs on a forwarder? (Select all that apply.)

Accepted Answer

A)  CLI 
B)  Edit inputs.conf Edit inputs.conf 
C)  Edit forwarder.conf forwarder.conf 
D)  Forwarder Management

Question 14

How does the Monitoring Console monitor forwarders?

Accepted Answer

A)  By pulling internal logs from forwarders. 
B)  By using the forwarder monitoring add-on. 
C)  With internal logs forwarded by forwarders. 
D)  With internal logs forwarded by deployment server.

Question 15

If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?

Accepted Answer

A)  Indexer 
B)  Forwarder 
C)  Search head 
D)  Deployment server

Question 16

In case of a conflict between a whitelist and a blacklist input setting, which one is used?

Accepted Answer

A)  Blacklist 
B)  Whitelist 
C)  They cancel each other out. 
D)  Whichever is entered into the configuration first.

Question 17

Which of the following are methods for adding inputs in Splunk? (Choose all that apply.)

Accepted Answer

A)  CLI 
B)  Splunk Web 
C)  Editing inpits.conf Editing inpits.conf 
D)  Editing monitor.conf monitor.conf

Question 18

Which layers are involved in Splunk configuration file layering? (Choose all that apply.)

Accepted Answer

A)  App context 
B)  User context 
C)  Global context 
D)  Forwarder context

Question 19

How is data handled by Splunk during the input phase of the data ingestion process?

Accepted Answer

A)  Data is treated as streams. 
B)  Data is broken up into events. 
C)  Data is initially written to disk. 
D)  Data is measured by the license meter.

Question 20

Which of the following must be done to define user permissions when integrating Splunk with LDAP?

Accepted Answer

A)  Map Users 
B)  Map Groups 
C)  Map LDAP Inheritance 
D)  Map LDAP to Active Directory

Exam 3: Splunk Certified Developer