SPLK-1003トレーニング最新認定問題をゲットSplunk Enterprise Certified Admin合格目指せ2021年12月23日 [Q18-Q39]

SPLK-1003トレーニング最新認定問題をゲットSplunk Enterprise Certified Admin合格目指せ2021年12月23日

認定トレーニングSPLK-1003試験問題集テストエンジン

質問 18
Which configuration files are used to transform raw data ingested by Splunk? (Choose all that apply.)

• A. transforms.conf
• B. inputs.conf
• C. props.conf
• D. rawdata.conf

正解: C

 

質問 19
Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

• A. Indexers
• B. Search head
• C. Forwarder
• D. Search peers

正解: A

解説:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Advancedindexingstrategy

 

質問 20
If an update is made to an attribute in inputs.conf on a universal forwarder, on which Splunk component would the fishbucket need to be reset in order to reindex the data?

• A. Indexer
• B. Search head
• C. Deployment server
• D. Forwarder

正解: A

解説:
Reference https://community.splunk.com/t5/Archive/How-to-reindex-data-from-a-forwarder/td-p/93310

 

質問 21
To set up a Network input in Splunk, what needs to be specified'?

• A. Username and password
• B. Network protocol and MAC address.
• C. File path.
• D. Network protocol and port number.

正解: D

 

質問 22
Which of the following indexes come pre-configured with Splunk Enterprise? (select all that apply)

• A. _license
• B. _thefishbucket
• C. _lnternal
• D. _external

正解: B,C

解説:
https://docs.splunk.com/Documentation/Splunk/8.0.5/Indexer/Howindexingworks

 

質問 23
How would you configure your distsearch conf to allow you to run the search below? sourcetype=access_combined status=200 action=purchase splunk_setver_group=HOUSTON A)

B)

C)

D)

• A. Option D
• B. Option B
• C. option A
• D. Option C

正解: D

 

質問 24
Which Splunk component does a search head primarily communicate with?

• A. Indexer
• B. Deployment server
• C. Forwarder
• D. Cluster master

正解: A

解説:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/InheritedDeployment/Deploymenttopology

 

質問 25
An index stores its data in buckets. Which default directories does Splunk use to store buckets? (Choose all that apply.)

• A. frozendb
• B. colddb
• C. bucketdb
• D. db

正解: B,D

 

質問 26
Which setting allows the configuration of Splunk to allow events to span over more than one line?

• A. BREAK_ONLY_BEFORE = <REGEX pattern>
• B. SHOULD_LINEMERGE = false
• C. BREAK_ONLY_BEFORE_DATE = true
• D. SHOULD_LINEMERGE = true

正解: A

 

質問 27
Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?

• A. props.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  KEY = _raw
• B. props.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• C. transforms.conf
  [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
• D. transforms.conf
  [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw

正解: D

解説:
because transforms.conf is the right configuration file to state the regex expression. https://docs.splunk.com/Documentation/Splunk/8.1.0/Admin/Transformsconf Reference:
433035

 

質問 28
In which phase of the index time process does the license metering occur?

• A. Parsing phase
• B. Indexing phase
• C. input phase
• D. Licensing phase

正解: C

 

質問 29
When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

• A. Irregular expression
• B. Slash notation
• C. Wildcard-only expression
• D. Regular expression

正解: D

解説:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Updating/Filterclients

 

質問 30
When deploying apps, which attribute in the forwarder management interface determines the apps that clients install?

• A. Client Class
• B. App Class
• C. Forwarder Class
• D. Server Class

正解: D

解説:
<https://docs.splunk.com/Documentation/Splunk/8.0.6/Updating/Deploymentserverarchitecture>
https://docs.splunk.com/Splexicon:Serverclass

 

質問 31
What are the required stanza attributes when configuring the transforms. conf to manipulate or remove events?

• A. REGEX. SRC_KEY, FORMAT
• B. REGEX, DEST_KEY FORMATTING
• C. REGEX, DEST_KEY, FORMAT
• D. REGEX, DEST. FORMAT

正解: C

解説:
REGEX = <regular expression>
* Enter a regular expression to operate on your data.
FORMAT = <string>
* NOTE: This option is valid for both index-time and search-time field extraction. Index-time field extraction configuration require the FORMAT settings. The FORMAT settings is optional for search-time field extraction configurations.
* This setting specifies the format of the event, including any field names or values you want to add.
DEST_KEY = <key>
* NOTE: This setting is only valid for index-time field extractions.
* Specifies where SPLUNK software stores the expanded FORMAT results in accordance with the REGEX match.

 

質問 32
After automatic load balancing is enabled on a forwarder, the time interval for switching indexers can be updated by using which of the following attributes?

• A. secsInFailurelnterval
• B. autoLBFrequency
• C. connectionTimeout
• D. channelTTL

正解: B

 

質問 33
On the deployment server, administrators can map clients to server classes using client filters. Which of the following statements is accurate?

• A. The blacklist takes precedence over the whitelist.
• B. Wildcards are not supported in any client filters.
• C. Machine type filters are applied before the whitelist and blacklist.
• D. The whitelist takes precedence over the blacklist.

正解: A

解説:
https://docs.splunk.com/Documentation/Splunk/8.2.1/Updating/Filterclients Reference:
same/td-p/390910

 

質問 34
Which Splunk configuration file is used to enable data integrity checking?

• A. props.conf
• B. global.conf
• C. data_integrity.conf
• D. indexes.conf

正解: D

 

質問 35
What is required when adding a native user to Splunk? (select all that apply)

• A. Username
• B. Default app
• C. Password
• D. Full Name

正解: A,C

 

質問 36
Which forwarder is recommended by Splunk to use in a production environment?

• A. Heavy forwarder
• B. Universal forwarder
• C. SSL forwarder
• D. Lightweight forwarder

正解: B

 

質問 37
Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?
props.conf

• A. [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
  transforms.conf
• B. [mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  KEY = _raw
  props.conf
• C. [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
  transforms.conf
• D. [mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw

正解: C

解説:
Explanation/Reference: https://community.splunk.com/t5/Archive/How-to-mask-SSN-into-our-logs-going-into-Splunk/td- p/433035

 

質問 38
Who provides the Application Secret, Integration, and Secret keys, as well as the API Hostname when setting up Duo for Multi-Factor Authentication in Splunk Enterprise?

• A. SAML Administrator
• B. Trio Administrator
• C. Duo Administrator
• D. LDAP Administrator

正解: C

解説:
Explanation/Reference: https://duo.com/docs/splunk

 

質問 39
......

Splunk SPLK-1003 認定試験の出題範囲：

トピック	出題範囲
トピック 1	Splunk構成ファイル Splunk構成ディレクトリ構造の説明 構成レイヤーの理解 構成の優先順位の理解
トピック 2	インデックス作成中の生データをマスクまたは削除 イベント値に基づいてソースタイプまたはホストをオーバーライド イベントコンテンツに基づいてイベントを特定のインデックスにルーティング
トピック 3	HTTPイベントコレクターの説明 入力フェーズ中に発生するデフォルト処理の理解 ソースタイプの微調整や文字セットエンコーディングなどの入力フェーズオプションの構成
トピック 4	リモートモニター入力の展開 ネットワークおよびスクリプト入力 ネットワーク（TCPおよびUDP）入力の作成 Windows入力の種類と用途の特定 基本的なスクリプト入力の作成
トピック 5	追加のフォワーダーオプションの特定 デプロイメント管理の使用の説明 Splunkデプロイメントサーバーの説明 デプロイメントアプリを使用したフォワーダーの管理
トピック 6	解析フェーズとデータ 解析中に発生するデフォルトの処理を理解する イベントの改行を最適化して構成する タイムスタンプとタイムゾーンがどのように抽出またはイベントに割り当てられるかを説明する
トピック 7	Splunk認証管理 SplunkとLDAPの統合 他のユーザー認証オプションの一覧表示 Splunkで多要素認証を有効にする手順の説明
トピック 8	Fishbucketの説明 データ保持ポリシーの適用 Splunkユーザー管理 Splunkのユーザーロールの説明 カスタムロールの作成 Splunkユーザーの追加
トピック 9	入力の基本設定の説明 Splunkフォワーダータイプの一覧表示 フォワーダーの構成 CLIを使用したUFへの入力の追加
トピック 10	Splunk管理の基本 Splunkコンポーネントの特定 ライセンス管理 ライセンスタイプの特定 ライセンス違反の理解
トピック 11	生データの操作 データプレビューを使用した解析フェーズでのイベント作成の検証 データ変換の定義と呼び出し方法の説明
トピック 12	btoolを使用して、構成設定の調査 Splunkインデックス インデックス構造の説明 インデックスバケットのタイプの一覧表示 インデックスデータの整合性の確認 Indexes.confオプションの説明
トピック 13	Splunkインデックス作成プロセスの3つのフェーズを一覧表示 Splunk入力オプションを一覧表示

 

合格確定、ガイドで準備SPLK-1003試験：https://jp.fast2test.com/SPLK-1003-premium-file.html

Splunk Enterprise Certified Admin SPLK-1003無料最新のリアル試験問題と回答：https://drive.google.com/open?id=1XteRjX9zVoNlls9ubWJ0Gv9eyIXlGU3x