Splunk SPLK-1005 Splunk Cloud Certified Admin Exam Exam Practice Test Questions

• Question 1

  A customer wants to mask unstructured data before sending it to Splunk Cloud. Where should SEBCMD be configured for this?

  • Props. conf on a Splunk Cloud search head,
  • Props.conf on a Heavy Forwarder.
  • Transforms, cent on a Splunk Cloud indexer.
  • Props. conf- on a Universal Forwarder.

  Show Answer Answer: B Next

• Question 2

  When a forwarder phones home to a Deployment Server it compares the check-sum value of the forwarder's app to the Deployment Server's app. What happens to the app If the check-sum values do not match?

  • The app on the forwarder is always deleted and re-downloaded from the Deployment Server.
  • The app on the forwarder is only deleted and re-downloaded from the Deployment Server if the forwarder's app has a smaller check-sum value.
  • The app is downloaded from the Deployment Server and the changes are merged.
  • A warning is generated on the Deployment Server stating the apps are out of sync. An Admin will need to confirm which version of the app should be used.

  Show Answer Answer: A Next

• Question 3

  In case of a Change Request, which of the following should submit a support case for Splunk Support?

  • The party requesting the change.
  • Certified Splunk Cloud administrator.
  • Splunk infrastructure owner.
  • Any person with the appropriate entitlement

  Show Answer Answer: D Next

• Question 4

  Which of the following methods is valid for creating index-time field extractions?

  • Use the UI to create a sourcetype, specify the field name and corresponding regular expression with capture statement.
  • Create a configuration app with the index-time props.conf and/or transfoms. conf, and upload the app via UI.
  • Use the CU app to define settings in fields.conf, and restart Splunk Cloud.
  • Use the rex command to extract the desired field, and then save as a calculated field.

  Show Answer Answer: B Next

• Question 5

  Which of the following is correct in regard to configuring a Universal Forwarder as an Intermediate Forwarder?

  • This can only be turned on using the Settings > Forwarding and Receiving menu in Splunk Web/UI.
  • The configuration changes can be made using Splunk Web. CU, directly in configuration files, or via a deployment app.
  • The configuration changes can be made using CU, directly in configuration files, or via a deployment app.
  • It is only possible to make this change directly in configuration files or via a deployment app.

  Show Answer Answer: D Next