Free Splunk Enterprise Certified Admin Practice Questions

A.  

in props.conf:[identity]REGEX-redact_pw = s/password=([^,|/s] +)/ ####REACTED####/g

B.  

in props.conf:[identity]SEDCMD-redact_pw = s/password=([^,|/s] +)/ ####REACTED####/g

C.  

in transforms.conf:[identity]SEDCMD-redact_pw = s/password=([^,|/s] +)/ ####REACTED####/g

D.  

in transforms.conf:[identity]REGEX-redact_pw = s/password=([^,|/s] +)/ ####REACTED####/g

A.  

wmi_inputs.conf

B.  

inputs.conf

C.  

None, the inputs are defined outside of Splunk.

D.  

wmi.conf

A.  

Any OS platform

B.  

Linux platform only

C.  

Windows platform only.

D.  

None of the above.

A.  

True

B.  

False

C.  

< regex string >

D.  

Newline Character

A.  

SEDCMD-1acct = s/VendorID=\d{3}(\d{4})/VendorID=xxx/g

B.  

SEDCMD-xxxAcct = s/AcctID=\d{3}(\d{4})/AcctID=xxx/g

C.  

SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=\1xxx/g

D.  

SEDCMD-1acct = s/AcctID=\d{3}(\d{4})/AcctID=xxx\1/g

A.  

LDAP group names must match the Splunk role name defined in authorize.conf.

B.  

Splunk will search each LDAP strategy in the order in which they are listed in authentication.conf.

C.  

Splunk only supports encrypted LDAP connections.

D.  

LDAP will take precedence over local users with the same username as defined in etc/passwd.

A.  

1 Request Login2. Connect to SAML server3 Duo MFA4 Create User session5 Authentication Granted 6. Log into Splunk

B.  

1. Request Login 2 Duo MFA3. Authentication Granted 4 Connect to SAML server5. Log into Splunk6. Create User session

C.  

1 Request Login2 Check authentication / group mapping3 Authentication Granted4. Duo MFA5. Create User session6. Log into Splunk

D.  

1 Request Login 2 Duo MFA3. Check authentication / group mapping4 Create User session5. Authentication Granted6 Log into Splunk

A.  

coldPath

B.  

homePath

C.  

frozenPath

D.  

thawedPath

A.  

splunk add one shot / opt/ incident [data .log —index incident

B.  

splunk edit monitor /opt/incident/data.* —index incident

C.  

splunk add monitor /opt/incident/data.log —index incident

D.  

splunk edit oneshot [opt/ incident/data.* —index incident

A.  

CLI

B.  

Edit inputs . conf

C.  

Edit forwarder.conf

D.  

Forwarder Management