Question 1
Which statement is correct?
Correct Answer:
D. Formatting commands such as fieldformat should occur as early as possible in the search to take full advantage of the often larger number of search peers.
Free Splunk Core Certified Consultant SPLK-3003 Exam Questions
Question 2
A customer wants to migrate from using Splunk local accounts to use Active Directory with LDAP for their Splunk user accounts instead. Which configuration files must be modified to connect to an Active Directory LDAP provider?
Correct Answer:
C. authentication.conf
Question 3
A customer's deployment server is overwhelmed with forwarder connections after adding an additional 1000 clients. The default phone home interval is set to 60 seconds. To reduce the number of connection failures to the DS what is recommended?
Correct Answer:
A. Create a tiered deployment server topology.
Question 4
A customer wants to implement LDAP because managing local Splunk users is becoming too much of an overhead. What configuration details are needed from the customer to implement LDAP authentication?
Correct Answer:
C. LDAP server: port, bind user credentials, base DN for groups, base DN for users.
Question 5
In which of the following scenarios is a subsearch the most appropriate?
Correct Answer:
A. When joining results from multiple indexes.
Question 6
A customer has downloaded the Splunk App for AWS from Splunkbase and installed it in a search head cluster following the instructions using the deployer. A power user modifies a dashboard in the app on one of the search head cluster members. The app containing an updated dashboard is upgraded to the latest version by following the instructions via the deployer.
What happens?
Correct Answer:
A. The updated dashboard will not be deployed globally to all users, due to the conflict with the power user's modified version of the dashboard.
Question 7
The Splunk Validated Architectures (SVAs) document provides a series of approved Splunk topologies. Which statement accurately describes how it should be used by a customer?
Correct Answer:
B. Customers should identify their requirements, provisionally choose an approved design that meets them, then consider design principles and best practices to come to an informed design decision.
Question 8
When a bucket rolls from cold to frozen on a clustered indexer, which of the following scenarios occurs?
Correct Answer:
B. Replicated copies of the bucket will remain on all other indexers and the Cluster Master (CM) assigns a new primary bucket.
Question 9
In a single indexer cluster, where should the Monitoring Console (MC) be installed?
Correct Answer:
C. Cluster master node
Question 10
A new search head cluster is being implemented. Which is the correct command to initialize the deployer node without restarting the search head cluster peers?
Correct Answer:
A. $SPLUNK_HOME/bin/splunk apply shcluster-bundle