splk-1005 Practice Test

Question 1

When monitoring directories that contain mixed file types, which setting should be omitted from inputs.conf and instead be overridden in props.conf?

1. sourcetype
2. host
3. source
4. index

Question 2

How are HTTP Event Collector (HEC) tokens configured in a managed Splunk Cloud environment?

1. Any token will be accepted by HEC, the data may just end up in the wrong index.
2. A token is generated when configuring a HEC input, which should be provided to the application developers.
3. Obtain a token from the organization’s application developers and apply it in Settings > Data Inputs > HTTP Event Collector > New Token.
4. Open a support case for each new data input and a token will be provided.

Question 3

The following Apache access log is being ingested into Splunk via a monitor input: How does Splunk determine the time zone for this event?

1. The value of the TZ attribute in props.conf for the access_combined sourcetype.
2. The value of the TZ attribute in props.conf for the my.webserver.example host.
3. The time zone of the Heavy/Intermediate Forwarder with the monitor input.
4. The time zone indicator in the raw event data.

Question 4

What syntax is required in inputs.conf to ingest data from files or directories?

1. A monitor stanza, sourcetype, and index is required to ingest data.
2. A monitor stanza, sourcetype, index, and host is required to ingest data.
3. A monitor stanza and sourcetype is required to ingest data.
4. Only the monitor stanza is required to ingest data.

Question 5

A user has been asked to mask some sensitive data without tampering with the structure of the file /var/log/purchases/transactions.log that has the following format: 2020-01-01 00:01:20 User=bob SuperSecretNumber=123456789012 Operation=purchase 2020-01-01 16:15:32 User=alice SuperSecretNumber=123456789012 Operation=purchase Which of the stanzas below will achieve this?