Question 1

The universal forwarder has which capabilities when sending data? (select all that apply)

Options :

A : Sending alerts

B : Compressing data

C : Obfuscating/hiding data

D : Indexer acknowledgement

Answer: B,D

Question 2

Using the CLI on the forwarder, how could the current forwarder to indexer configuration be viewed?

Options :

A : splunk btool server list --debug

B : splunk list forward-indexer

C : splunk list forward-server

D : splunk btool indexes list --debug

Answer: C

Question 3

In which Splunk configuration is the SEDCMD used?

Options :

A : props, conf

B : inputs.conf

C : indexes.conf

D : transforms.conf

Answer: A

Question 4

Which of the following types of data count against the license daily quota?

Options :

A : Replicated data

B : splunkd logs

C : Summary index data

D : Windows internal logs

Answer: D

Question 5

When enabling data integrity control, where does Splunk Enterprise store the hash files for each bucket?

Options :

A : Splunk Enterprise stores hash files in the logdata directory of the corresponding bucket.

B : Splunk Enterprise stores hash files in the rawdata directory of the corresponding bucket.

C : Splunk Enterprise stores hash files in the hashdata directory of the corresponding bucket.

D : Splunk Enterprise stores hash files in the metadata directory of the corresponding bucket.

Answer: B

Free SPLK-1003 Mock Exam – Practice Online Confidently