最新的Splunk Cloud Certified Admin認證 SPLK-1005考試題庫

問題1

What is the name of the Splunk index that contains the most valuable information for troubleshooting a Splunk issue?

A. defaultdb

B. _monitoring

C. _internal

D. lastchanceindex

正確答案: C

說明：（僅 VCESoft 成員可見）

問題2

What is the recommended approach to collect data from network devices?

A. TCP/UDP Feed > Intermediate Forwarder > Heavy Forwarder > Splunk Cloud

B. TCP/UDP Feed > Heavy Forwarder > Intermediate Forwarder > Splunk Cloud

C. TCP/UDP Feed > Universal Forwarder > Intermediate Forwarder > Splunk Cloud

D. TCP/UDP Feed > Syslog Server with Universal Forwarder > Splunk Cloud

正確答案: D

說明：（僅 VCESoft 成員可見）

問題3

Which of the following statements is true regarding sedcmd?

A. SEDCMD can be defined in either props.conf or transforms.conf.

B. SEDCMD does not work on Windows-based installations of Splunk.

C. SEDCMD provides search and replace functionality using regular expressions and substitutions.

D. SEDCMD uses the same syntax as Splunk's replace command.

正確答案: C

說明：（僅 VCESoft 成員可見）

問題4

A monitor has been created in inputs. con: for a directory that contains a mix of file types. How would a Cloud Admin fine-tune assigned sourcetypes for different files in the directory during the input phase?

A. On the Indexer parsing the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza.

B. On the forwarder collecting the data, set multiple 3ourcotype_sourc?attributes for the directory monitor collecting the files. Then create a props. conf that filters out unwanted files.

C. On the Indexer parsing the data, set multiple sourcetype_source attributes for the directory monitor collecting the files. Then create a props, com that filters out unwanted files.

D. On the forwarder collecting the data, leave sourcetype as automatic for the directory monitor.
Then create a props. conf that assigns a specific sourcetype by source stanza.

正確答案: D

說明：（僅 VCESoft 成員可見）

問題5

Which of the following files is used for both search-time and index-time configuration?

A. macros.conf

B. props.conf

C. savesearch.conf

D. inputs.conf

正確答案: B

說明：（僅 VCESoft 成員可見）

問題6

Which of the following stanzas would enable a TCP input on port 1025, allowing traffic from all IP addresses except 10.5.5.1?

A. [tcp://1025]
acceptFrom = !10.5.5.1

B. [tcp://1025]
acceptFrom = 10.5.5.1

C. [tcp://1025]

D. [tcp://10.5.5.1:1025]

正確答案: A

說明：（僅 VCESoft 成員可見）

問題7

Which of the following tasks is not managed by the Splunk Cloud administrator?

A. Creating users and roles.

B. Managing knowledge objects.

C. Upgrading the indexer's Splunk software.

D. Forwarding events to Splunk Cloud.

正確答案: C

說明：（僅 VCESoft 成員可見）

最新的Splunk Cloud Certified Admin - SPLK-1005免費考試真題

最新更新

站內鏈接

聯系我們