Splunk Core Certified Consultant (SPLK-3003) Free Practice Test

Question 1

Which of the following is the most efficient search?

A.

B.

C.

D.

Correct Answer: A

Question 2

A customer has a Universal Forwarder (UF) with an inputs.conf monitoring its splunkd.log. The data is sent through a heavy forwarder to an indexer.
Where does the Index time parsing occur?

A. Indexer

B. Universal forwarder

C. Search head

D. Heavy forwarder

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

Which command is most efficient in finding the pass4SymmKey of an index cluster?

A. find / -name server.conf ""print | grep pass4SymKey

B. $SPLUNK_HOME/bin/splunk btool server list clustering | grep pass4SymmKey

C. $SPLUNK_HOME/bin/splunk btool clustering list clustering --debug | grep pass4SymmKey

D. $SPLUNK_HOME/bin/splunk search | rest splunk_server=local /servicesNS/-
/unhash_app/storage/passwords

Correct Answer: B

Question 4

In addition to the normal responsibilities of a search head cluster captain, which of the following is a default behavior?

A. The captain is not a cluster member and does not perform normal search activities.

B. The captain is not a cluster member but does perform normal search activities.

C. The captain is a cluster member but does not perform normal search activities.

D. The captain is a cluster member who performs normal search activities.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 5

What happens when an index cluster peer freezes a bucket?

A. All indexers with a copy of the bucket will delete it.

B. All indexers with a copy of the bucket will immediately roll it to frozen.

C. The cluster master will ensure another copy of the bucket is made on the other peers to meet the replication settings.

D. The cluster master will no longer perform fix-up activities for the bucket.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 6

Where does the bloomfilter reside?

A. $SPLUNK_HOME/var/lib/splunk/fishbucket

B. $SPLUNK_HOME/var/lib/splunk/indexfoo/db/db_1553504858_1553504507_8/rawdata

C. $SPLUNK_HOME/var/lib/splunk/indexfoo/db/db_1553504858_1553504507_8/*.tsidx

D. $SPLUNK_HOME/var/lib/splunk/indexfoo/db/db_1553504858_1553504507_8

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 7

A site from a multi-site indexer cluster needs to be decommissioned. Which of the following actions must be taken?

A. Create an alias for where the new data should be sent.

B. Nothing. Decommissioning a site is not possible.

C. Remove the site from the list of available sites and create an alias for where the new data should be sent.

D. Remove the site from the list of available sites.

Correct Answer: C

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 8

What should be considered when running the following CLI commands with a goal of accelerating an index cluster migration to new hardware?

A. SSL data encryption

B. Network latency and storage IOPS

C. Distance and location

D. Data ingestion rate

Correct Answer: B

Question 9

A customer wants to implement LDAP because managing local Splunk users is becoming too much of an overhead. What configuration details are needed from the customer to implement LDAP authentication?

A. API: Python script with PAM/RADIUS details.

B. LDAP REST details, base DN for groups, base DN for users.

C. LDAP server: port, bind user credentials, path/to/groups, path/to/user.

D. LDAP server: port, bind user credentials, base DN for groups, base DN for users.

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

Splunk Core Certified Consultant (SPLK-3003) Free Practice Test