SPLK-1005 Leak Questions

Page: 4 / 5

Question 16

Which of the following methods is valid for creating index-time field extractions?

Options:

Use the UI to create a sourcetype, specify the field name and corresponding regular expression with capture statement.

Create a configuration app with the index-time props.conf and/or transfoms. conf, and upload the app via UI.

Use the CU app to define settings in fields.conf, and restart Splunk Cloud.

Use the rex command to extract the desired field, and then save as a calculated field.

Question 17

Which of the following is a correct statement about Universal Forwarders?

Options:

The Universal Forwarder must be able to contact the license master.

A Universal Forwarder must connect to Splunk Cloud via a Heavy Forwarder.

A Universal Forwarder can be an Intermediate Forwarder.

The default output bandwidth is 500KBps.

Question 18

A Splunk Cloud administrator is looking to allow a new group of Splunk users in the marketing department to access the Splunk environment and view a dashboard with relevant data. These users need to access marketing data (stored in the marketing_data index), but shouldn't be able to access other data, such as events related to security or operations.

Which approach would be the best way to accomplish these requirements?

Options:

Create a new user with access to the marketing_data index assigned.

Create a new role that inherits the user role and remove the capability to search indexes other than marketing_data.

Create a new role that inherits the admin rote and assign access to the marketing_dat.a index.

Create a new role that does not inherit from any other role, turn on the same capabilities as the user role, and assign access to the marketing_data index.