Exam (elaborations)
Splunk Certified Admin Exam Questions Solved 100% Correc
- Course
- Institution
Splunk Certified Admin Exam Questions Solved 100% Correc
[Show more]
Seller
Follow
Content preview
Splunk Certified Admin Exam Questions Solved100% Correct
if you want a role that is "like" the user role, but with some capabilities turned off, you
can create a new role that inherits from the user role, then remove some capabilities? -
Answer False
you have to create a new role, since you can't turn off capabilities when inheriting from
a user
True or False
you can unlock a user from the command line - Answer True
True or False
you have to configure a separate receiving port on the indexer for each universal
forwarder - Answer False, You can just use 9997 or whatever port you specify
True or False
When a Universal forwarder is installed on Windows, the instance provides a GUI -
Answer False
Universal forwarders do not have a GUI on Windows or any other OS
True or False
Knowledge bundles contain the knowledge objects required by the indexers for
searching - Answer True
A quarantined search peer is prevented from performing new searches but continues to
attempt to service - Answer True
,True or False?
When adding a Search Peer (Search Head), you have to enter a username/password of
an account on the search peer, and the account must have the edit_roles capability. -
Answer False
The account must have edit_user capability
True or False?
Search Head Clustering and Indexer clustering are the only two types of clustering
provided by Splunk - Answer True
True or False?
Monitoring Console(MC) can be used by the user and power user roles. - Answer True
True or False?
Monitoring Console(MC) can be used by the user and power user roles? - Answer False
Only admin role can use the MC
True or False
MC runs un-configured in standalone mode by default - Answer True
True or false
The monitoring console does not come with preconfigured health checks - Answer False
MC comes with preconfigured health checks
True or false
Health checks can be disabled, modified, created and exported - Answer True
, True or false
Splunk Enterprise 6.5+ provides warnings, but does not disable searching during the
violation period - Answer True
Which Splunk component does a search head primarily communicate with? - Answer
Indexer
What type of data is counted against the Enterprise License at a fixed 150 bytes per
event? - Answer Metrics Data
How often does Splunk recheck the LDAP server? - Answer varies based on
LDAP_refresh setting
How do you remove missing forwarders from the Monitoring Console? - Answer By
rebuilding the forwarder asset table
What are methods for adding inputs in Splunk? - Answer CLI
Editing inputs.conf
Splunk Web
What are the required stanza attributes when configuring the transforms.conf to
manipulate or remove events? - Answer REGEX, DEST_KEY, FORMAT
Which Splunk component performs indexing and responds to search requests form the
search head? - Answer Search Peer
Why would a Splunk Administrator want to enable data integrity checking? - Answer To
ensure that data has not been tampered with for auditing/legal purposes
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller KenAli. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $12.99. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
81113 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now