初心者向けのSPLK-1005試験 [2025] 問題集でSplunkのPDF問題
SPLK-1005プレミアム試験エンジンPDFをダウンロード
質問 # 40
When creating a new index, which of the following is true about archiving expired events?
- A. Expired events cannot be archived.
- B. Store expired events on-prem using your own storage systems.
- C. Archive some expired events from an index and discard others.
- D. Store expired events in private AWS-based storage.
正解：B
解説：
Explanation: In Splunk Cloud, expired events can be archived to customer-managed storage solutions, such as on-premises storage. This allows organizations to retain data beyond the standard retention period if needed. [Reference: Splunk Docs on data archiving in Splunk Cloud]
質問 # 41
Which of the following is true when integrating LDAP authentication?
- A. The mapping of LDAP groups to Splunk roles happens automatically.
- B. Splunk stores LDAP end user names and passwords on search heads.
- C. Splunk Cloud only supports Active Directory LDAP servers.
- D. New user data is cached the first time a user logs in.
正解：D
解説：
When integrating LDAP authentication with Splunk, new user data is cached the first time a user logs in. This means that Splunk does not store LDAP usernames and passwords; instead, it relies on the LDAP server for authentication. The mapping of LDAP groups to Splunk roles must be configured manually; it does not happen automatically. Additionally, Splunk Cloud supports various LDAP servers, not just Active Directory.
Splunk Documentation Reference: LDAP Authentication
質問 # 42
Which command can be used to install the Splunk universal forwarder credentials package on the universal forwarder machine?
- A. splunk install forwarder-credentials <path_to_credentials_package>
- B. splunk add forwarder-credentials <path_to_credentials_package>
- C. splunk install app <path_to_credentials_package>
- D. splunk add app <path_to_credentials_package>
正解：C
質問 # 43
Which of the following is correct in regard to configuring a Universal Forwarder as an Intermediate Forwarder?
- A. This can only be turned on using the Settings > Forwarding and Receiving menu in Splunk Web/UI.
- B. The configuration changes can be made using CU, directly in configuration files, or via a deployment app.
- C. It is only possible to make this change directly in configuration files or via a deployment app.
- D. The configuration changes can be made using Splunk Web. CU, directly in configuration files, or via a deployment app.
正解：C
解説：
Configuring a Universal Forwarder (UF) as an Intermediate Forwarder involves making changes to its configuration to allow it to receive data from other forwarders before sending it to indexers.
* D. It is only possible to make this change directly in configuration files or via a deployment app:
This is the correct answer. Configuring a Universal Forwarder as an Intermediate Forwarder is done by editing the configuration files directly (like outputs.conf), or by deploying a pre-configured app via a deployment server. The Splunk Web UI (Management Console) does not provide an interface for configuring a Universal Forwarder as an Intermediate Forwarder.
* A. This can only be turned on using the Settings > Forwarding and Receiving menu in Splunk Web/UI:Incorrect, as this applies to Heavy Forwarders, not Universal Forwarders.
* B. The configuration changes can be made using Splunk Web, CLI, directly in configuration files, or via a deployment app:Incorrect, the Splunk Web UI is not used for configuring Universal Forwarders.
* C. The configuration changes can be made using CLI, directly in configuration files, or via a deployment app:While CLI could be used for certain configurations, the specific Intermediate Forwarder setup is typically done via configuration files or deployment apps.
Splunk Documentation References:
* Universal Forwarder Configuration
* Intermediate Forwarder Configuration
質問 # 44
Which Splunk add-on simplifies the process of getting data into Splunk Cloud Platform from Windows Event Log channels?
- A. Splunk Add-on for Active Directory
- B. Splunk Add-on for Windows
- C. Splunk Add-on for DNS
- D. Splunk Add-on for Infrastructure
正解：B
質問 # 45
Which of the following tasks is the responsibility of a Splunk Cloud administrator?
- A. Configuring indexes
- B. Configuring deployer
- C. Configuring indexers
- D. Configuring cluster master
正解：A
解説：
In Splunk Cloud, configuring indexes is one of the primary responsibilities of a Splunk Cloud administrator.
This task includes setting up new indexes, managing retention policies, and configuring index settings as required by the organization's data retention and compliance policies. Other tasks like configuring deployer, cluster master, or indexers are typically handled by Splunk Enterprise administrators, not Splunk Cloud administrators.
Splunk Documentation Reference: Splunk Cloud Administrator Guide
質問 # 46
Which of the following are features of a managed Splunk Cloud environment?
- A. Availability of premium apps, no IP address whitelisting or blacklisting, deployed in US East AWS region.
- B. Availability of premium apps, SSO integration, IP address whitelisting and blacklisting.
- C. 20GB daily maximum data ingestion, no SSO integration, no availability of premium apps.
- D. Availability of premium apps, SSO integration, maximum concurrent search limit of 20.
正解：B
解説：
In a managed Splunk Cloud environment, several features are available to ensure that the platform is secure, scalable, and meets enterprise requirements. The key features include:
* Availability of premium apps:Splunk Cloud supports the installation and use of premium apps such as Splunk Enterprise Security, IT Service Intelligence, etc.
* SSO Integration:Single Sign-On (SSO) integration is supported, allowing organizations to leverage their existing identity providers for authentication.
* IP address whitelisting and blacklisting:To enhance security, managed Splunk Cloud environments allow for IP address whitelisting and blacklisting to control access.
Given the options:
* Option Ccorrectly lists these features, making it the accurate choice.
* Option Aincorrectly states "no IP address whitelisting or blacklisting," which is indeed available.
* Option Bmentions "no SSO integration" and "no availability of premium apps," both of which are inaccurate.
* Option Dtalks about a "maximum concurrent search limit of 20," which does not represent the standard limit settings and may vary based on the subscription level.
Splunk Documentation References:
* Splunk Cloud Features and Capabilities
* Single Sign-On (SSO) in Splunk Cloud
* Security and Access Control in Splunk Cloud
質問 # 47
Which setting in inputs.conf can be used to specify the maximum size of a file that can be monitored by Splunk?
- A. max_file_size
- B. max_file_bytes
- C. max_file_count
- D. max_file_age
正解：A
質問 # 48
What is the name of the default field that stores the timestamps in UNIX time when data is indexed?
- A. _epoch
- B. _time
- C. _timestamp
- D. _date
正解：B
質問 # 49
Which command can be used to install a universal forwarder on a Linux system?
- A. splunk forwarder install
- B. splunk add forward-server
- C. splunk enable boot-start
- D. splunk install forwarder
正解：D
質問 # 50
What are the three types of data that indexes contain in Splunk Cloud?
- A. Raw data, index data, and event data
- B. Raw data, index data, and metrics data
- C. Raw data, event data, and metadata
- D. Raw data, index data, and metadata
正解：D
質問 # 51
When adding a directory monitor and specifying a sourcetype explicitly, it applies to all files in the directory and subdirectories. If automatic sourcetyping is used, a user can selectively override it in which file on the forwarder?
- A. transforms.conf
- B. outputs.cont
- C. props.conf
- D. inputs.conf
正解：C
解説：
When a directory monitor is set up with automatic sourcetyping, a user can selectively override the sourcetype assignment by configuring the props.conf file on the forwarder. The props.conf file allows you to define how data should be parsed and processed, including assigning or overriding sourcetypes for specific data inputs.
Splunk Documentation Reference: props.conf configuration
質問 # 52
What is the name of the Splunk Enterprise feature that provides a security data and event management (SIEM) solution that uses machine data to detect and respond to threats?
- A. Splunk Enterprise Security
- B. Splunk Enterprise Monitoring
- C. Splunk Enterprise Intelligence
- D. Splunk Enterprise Analytics
正解：A
質問 # 53
Which setting in inputs.conf can be used to specify the SSL certificate for a TCP or UDP input?
- A. sslPassword
- B. sslRootCAPath
- C. sslCertPath
- D. All of the above
正解：D
質問 # 54
Which statement is true about monitor inputs?
- A. Monitor inputs can ignore a file's existing content, indexing new data as it arrives, by configuring the tailProcessor option.
- B. The ignoreOlderThan option allows files to be ignored based on the file modification time.
- C. Monitor inputs are configured in the monitor, conf file.
- D. ThecrSaltsetting is required.
正解：B
解説：
The statement about monitor inputs that is true is that the ignoreOlderThan option allows files to be ignored based on their file modification time. This setting helps prevent Splunk from indexing older data that is not relevant or needed.
Splunk Documentation Reference: Monitor files and directories
質問 # 55
Which attribute in outputs.conf can be used to specify the load balancing method for a group of forwarders?
- A. lb_method
- B. autoLB
- C. autoLBFrequency
- D. lb_poll
正解：A
質問 # 56
Which feature of forwarders can protect the data from unauthorized access or tampering?
- A. SSL security
- B. Data masking
- C. Data compression
- D. Data encryption
正解：A
質問 # 57
Which Windows-specific input type allows Splunk software to read special Windows log files such as the DNS debug server log?
- A. Windows Event Log
- B. Windows Registry
- C. Windows Management Instrumentation (WMI)
- D. MonitorNoHandle
正解：D
質問 # 58
Which file processor can be used to index files that are not actively written to or updated?
- A. Monitor
- B. MonitornoHandle
- C. Upload
- D. None of the above
正解：C
質問 # 59
......
あなたを合格させるSplunk試験にはSPLK-1005試験問題集：https://jp.fast2test.com/SPLK-1005-premium-file.html