Splunk SPLK-3003 Exam Dumps

Splunk Core Certified Consultant

Splunk SPLK-3003 Sample Questions

Question # 1

A customer has three users and is planning to ingest 250GB of data per day. They are concerned with search uptime, can tolerate up to a two-hour downtime for the search tier, and want advice on single search head versus a search head cluster. (SHC).Which recommendation is the most appropriate? 

A. The customer should deploy two active search heads behind a load balancer to support HA.
B. The customer should deploy a SHC with a single member for HA; more members can be added later.
C. The customer should deploy a SHC, because it will be required to support the high volume of data.
D. The customer should deploy a single search head with a warm standby search head and an rsync process to synchronize configurations.

Show Answer

Question # 2

A customer would like Splunk to delete files after they’ve been ingested. The Universal Forwarder has read/ write access to the directory structure. Which input type would be most appropriate to use in order to ensure files are ingested and then deleted afterwards?

A. Script
B. Batch
C. Monitor
D. Fschange

Show Answer

Question # 3

A working search head cluster has been set up and used for 6 months with just the native/local Splunk user authentication method. In order to integrate the search heads with an external Active Directory server using LDAP, which of the following statements represents the most appropriate method to deploy the configuration to the servers?

A. Configure the integration in a base configuration app located in shcluster-apps directory on the search head deployer, then deploy the configuration to the search heads using the splunk apply shclusterbundle command.
B. Log onto each search using a command line utility. Modify the authentication.conf and authorize.conf files in a base configuration app to configure the integration.
C. Configure the LDAP integration on one Search Head using the Settings > Access Controls > Authentication Method and Settings > Access Controls > Roles Splunk UI menus. The configuration setting will replicate to the other nodes in the search head cluster eliminating the need to do this on the other search heads.
D. On each search head, login and configure the LDAP integration using the Settings > Access Controls > Authentication Method and Settings > Access Controls > Roles Splunk UI menus.

Show Answer

Question # 4

A customer has implemented their own Role Based Access Control (RBAC) model to attempt to give the Security team different data access than the Operations team by creating two new Splunk roles – security and operations. In the srchIndexesAllowed setting of authorize.conf, they specified the network index under the security role and the operations index under the operations role. The new roles are set up to inherit the default user role. If a new user is created and assigned to the operations role only, which indexes will the user have access to search? 

A. operations, network, _internal, _audit
B. operations
C. No Indexes
D. operations, network

Show Answer

Question # 5

A customer has a number of inefficient regex replacement transforms being applied. When under heavy load the indexers are struggling to maintain the expected indexing rate. In a worst case scenario, which queue(s) would be expected to fill up? 

A. Typing, merging, parsing, input 
B. Parsing
C. Typing 
D. Indexing, typing, merging, parsing, input

Show Answer

Question # 6

Which statement is correct? 

A. In general, search commands that can be distributed to the search peers should occur as early as possible in a well-tuned search.
B. As a streaming command, streamstats performs better than stats since stats is just a reporting command.
C. When trying to reduce a search result to unique elements, the dedup command is the only way to achieve this.
D. Formatting commands such as fieldformat should occur as early as possible in the search to take full advantage of the often larger number of search peers. 

Show Answer