SPLK-2001 Splunk Exam Questions and Free Practice Test

Which files within an app contain permissions information? (Select all that apply.)

A. local/metadata.conf

B. metadata/local.meta

C. default/metadata.conf

D. metadata/default.meta

Correct Answer:CD

Which of the following are valid parent elements for the event action shown below? (Select all that apply.)
sourcetype=$click.value|s$>

A. <eval>

Correct Answer:AC

What predefined drilldown tokens are available specifically for trellis layouts? (Select all that apply.)

A. trellis.Xaxis

B. trellis.Yaxis

C. trellis.name

D. trellis.value

Correct Answer:CD

Which of the following are security best practices for Splunk app development? (Select all that apply.)

A. Store passwords in clear text in .conf files.

B. Implement security in software development lifecycle.

C. Manually test application with the controls listed in the OWASP Security Testing Guide.

D. Use a dynamic scanner such as OWASP ZAP to scan web application components for vulnerabilities.

Correct Answer:CD

Which of the following options would be the best way to identify processor bottlenecks of a search?

A. Using the REST API.

B. Using the search job inspector.

C. Using the Splunk Monitoring Console.

D. Searching the Splunk logs using index=?? internal??.

Correct Answer:C

What must be done when calling the serviceNS endpoint?

A. Authenticate with an admin user.

B. Specify the user and app context in the URI.

C. Authenticate with the user of the required context.

D. Pass the user and app context in the request payload.

Correct Answer:B

START SPLK-2001 EXAM