SPLK-1003 Splunk Exam Questions and Free Practice Test

What is the correct order of steps in Duo Multifactor Authentication?

A. * 1. Request Login* 2. Connect to SAML server* 3. Duo MFA* 4. Create User session* 5. Authentication Granted* 6. Log into Splunk

B. * 1. Request Login* 2. Duo MFA* 3. Authentication Granted* 4. Connect to SAML server* 5. Log into Splunk* 6. Create User session

C. * 1. Request Login* 2. Check authentication / group mapping* 3. Authentication Granted* 4. Duo MFA* 5. Create User session* 6. Log into Splunk

D. * 1. Request Login* 2. Duo MFA* 3. Check authentication / group mapping* 4. Create User session* 5. Authentication Granted* 6. Log into Splunk

Correct Answer:C
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/ConfigureDuo

Which setting in indexes.conf allows data retention to be controlled by time?

A. maxDaysToKeep

B. moveToFrozenAfter

C. maxDataRetentionTime

D. frozenTimePeriodInSecs

Correct Answer:D
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/SmartStoredataretention

Which Splunk component performs indexing and responds to search requests from the search head?

A. Forwarder

B. Search peer

C. License master

D. Search head cluster

Correct Answer:B
Reference: https://www.edureka.co/blog/splunk-architecture/

Where are license files stored?

A. $SPLUNK_HOME/etc/secure

B. $SPLUNK_HOME/etc/system

C. $SPLUNK_HOME/etc/licenses

D. $SPLUNK_HOME/etc/apps/licenses

Correct Answer:C
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/LicenserCLIcommands

With authentication methods are natively supported within Splunk Enterprise? (Select all that apply.)

A. LDAP

B. SAML

C. RADIUS

D. Duo Multifactor Authentication

Correct Answer:AD
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/SetupuserauthenticationwithSplunk

What is the difference between the two wildcards ... and * for the monitor stanza in inputs.conf?

A. ... is not supported in monitor stanzas.

B. There is no difference, they are interchangeable and match anything beyond directory boundaries.

C. * matches anything in that specific directory path segment, whereas ... recurses through subdirectories as well.

D. ... matches anything in that specific directory path segment, whereas * recurses through subdirectories as well.

Correct Answer:C
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.0/Data/Specifyinputpathswithwildcards

START SPLK-1003 EXAM