Splunk SPLK-1005 Exam Actual Questions

Topic 1 - Exam A

Question #1 Topic 1

When monitoring directories that contain mixed file types, which setting should be omitted from inputs.conf and instead be overridden in props.conf?

Reveal Solution Discussion

Correct Answer: A 🗳️

Question #2 Topic 1

How are HTTP Event Collector (HEC) tokens configured in a managed Splunk Cloud environment?

A. Any token will be accepted by HEC, the data may just end up in the wrong index.
B. A token is generated when configuring a HEC input, which should be provided to the application developers.
C. Obtain a token from the organization’s application developers and apply it in Settings > Data Inputs > HTTP Event Collector > New Token.
D. Open a support case for each new data input and a token will be provided.

Reveal Solution Discussion

Correct Answer: B 🗳️

Question #3 Topic 1

The following Apache access log is being ingested into Splunk via a monitor input:

How does Splunk determine the time zone for this event?

A. The value of the TZ attribute in props.conf for the access_combined sourcetype.
B. The value of the TZ attribute in props.conf for the my.webserver.example host.
C. The time zone of the Heavy/Intermediate Forwarder with the monitor input.
D. The time zone indicator in the raw event data.

Reveal Solution Discussion

Correct Answer: D 🗳️

Question #4 Topic 1

What syntax is required in inputs.conf to ingest data from files or directories?

Reveal Solution Discussion

Correct Answer: D 🗳️