Exam (elaborations)
SPLUNK CERTIFIED ADMIN2 QUESTIONS AND ANSWERS
- Course
- Institution
SPLUNK CERTIFIED ADMIN2 QUESTIONS AND ANSWERS
[Show more]
Content preview
SPLUNK CERTIFIED ADMIN2 QUESTIONS ANDANSWERS
Which parent directory contains the configuration files in Splunk? - Answers-
$SPLUNK_HOME/etc
Where can scripts for scripted inputs reside on the host file system? - Answers-
$SPLUNK_HOME/bin/scripts
$SPLUNK_HOME/etc/system/bin
In which Splunk configuration is the SEDCMD used - Answers-props.conf
User Role inheritance allows what to be inherited? - Answers-Capabilities
Index Access
What are the correct order of steps in Duo Multifactor Authentication? - Answers-1.
Request login
2.Duo MFA
3.Authentication Granted
4. Connect to SAML server
5. Log in to Splunk
6. Create user session
Which Splunk component consolidates the individual results and prepares reports in a
distributed environment? - Answers-Search Head
Within the props.conf, which stanzas are valid for data modification? - Answers-
Sourcetype
Source
Host
To set up a network input in Splunk, what needs to be specified? - Answers-Network
Protocol and port number
What enables compression for the universal forwarders in the outputs.conf? - Answers-
[tcpout] defaultgroup=my_indexers compressed=true
In which phase of the index time process does the license metering occur? - Answers-
indexing phase
The priority of layered Splunk configuration files depends on the fileos: - Answers-
Context
What are supported configuration methods to add inputs on a forwarder? - Answers-Edit
inputs.conf
, Forwarder Management
CLI
When running this command what is the default path in which deploymentserver.conf is
created?
Splunk set deploy-poll deployserver:port - Answers-SPLUNK_HOME/etc/system/local
What statements describe deployment management? - Answers-Requires an Enterprise
license
Is responsible for sending apps to forwarders
Where should apps be located on the deployment server that clients pull from? -
Answers-$SPLUNK_HOME/etc/deployment-apps
Which Splunk forwarder type allows parsing of data before forwarding to an indexer? -
Answers-Heavy forwarder
In the case of a conflict between a whitelist and blacklist input setting, which one is
used? - Answers-Blacklist
Which forwarder type can parse data prior to forwarding? - Answers-Heavy forwarder
What options are available when creating custom roles? - Answers-Allow or restrict
indexes that can be searched
Limit the number of concurrent search jobs
Restrict search terms
Which Splunk component distributes apps and certain other configuration updates to
search head cluster members? - Answers-Deployer
Which optional configuration setting in inputs.conf allow you to selectively forward the
data to the specific indexer(s)? - Answers-TCP_ROUTING
During search time, which directory of configuration files has the highest precedence? -
Answers-$SPLUNK_HOME/etc/users/admin/local
The Universal forwarder has which capabilities when sending data? - Answers-
Compressing data
Indexer acknowledgement
How does the Monitoring console monitor forwarders? - Answers-With internal logs
forwarded by forwarders
Which setting in indexes.conf alows data retention to be controlled by time? - Answers-
frozen timeperiodinsecs
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller GEEKA. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $12.49. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
81989 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now