Splunk SPLK-2001 Exam Questions Instant Access

Question 1

Which of the following is an example of a Splunk KV store use case? (Select all that apply.)

AStores checkpoint data for modular inputs.

BTracks workflow in an incident-review system.

CIndexes metrics data from remote HTTP sources.

DStores application state as a user interacts with an app.

Answer : A, B

Question 2

Which statements are true regarding HEC (HTTP Event Collector) tokens? (Select all that apply.)

AMultiple tokens can be created for use with different sourcetypes and indexes.

BThe edit token http admin role capability is required to create a token.

CTo create a token, send a POST request to services/collector endpoint.

DTokens can be edited using the data/inputs/http/{tokenName} endpoint.

Answer : A, C

Question 3

Which HTTP Event Collector (HEC) endpoint should be used to collect data in the following format?

{''message'':''Hello World'', ''foo'':''bar'', ''pony'':''buttercup''}

Adata/inputs/http/{name}

Bservices/collector/raw

Cservices/collector

Ddata/inputs/http

Answer : B

Question 4

What application security best practices should be adhered to while developing an app for Splunk? (Select all that apply.)

AReview the OWASP Top Ten List.

BStore passwords in clear text in .conf files.

CReview the OWASP Secure Coding Practices Quick Reference Guide.

DEnsure that third-party libraries that the app depends on have no outstanding CVE vulnerabilities.

Answer : A, C

Question 5

Which of the following are true of auto-refresh for dashboard panels? (Select all that apply.)

AApplies to inline searches and saved searches.

BEnabling auto-refresh for a report requires editing XML.

CPost-processing searches are refreshed when their base searches are refreshed.

DEach post-processing search using the same base search can have a different refresh time.

Answer : B, C

Question 6

Which of the following endpoints is used to authenticate with the Splunk REST API?

A/services/auth/login

B/services/session/login

C/services/auth/session/login

D/servicesNS/authentication/login

Answer : A

Question 7

Using Splunk Web to modify config settings for a shared object, a revised config file with those changes is placed in which directory?

A$SPLUNK_HOME/etc/apps/myApp/local

B$SPLUNK_HOME/etc/system/default/

C$SPLUNK_HOME/etc/system/local

D$SPLUNK_HOME/etc/apps/myApp/default

Answer : A

Splunk Certified Developer SPLK-2001 Exam Questions