SPLUNK CORE CERTIFIED
USER PRACTICE EXAM 60
QUESTIONS COMPLETE
Question 1: In a basic Splunk deployment, which component primarily stores indexed data and processes searches against that data?
Choices:
1) Universal forwarder 2) Indexer 3) Deployment server 4) License manager
Correct Answer: Indexer
Explanation: The indexer receives and indexes machine data, stores the resulting indexes, and processes searches that access that indexed data.Page 1
Question 2: What is the best description of a Splunk app?
Choices:
1) A hardware appliance used only for indexing 2) A container of con�gurations and knowledge objects designed for a particular use case 3) A license �le that enables premium features 4) A mandatory operating-system service for every data source Correct Answer: A container of con�gurations and knowledge objects designed for a particular use case Explanation: A Splunk app packages con�gurations, dashboards, reports, knowledge objects, and other content for a particular purpose or use case.Question 3: A user wants to change how times are displayed for that user's Splunk sessions without changing the server's system time. Which type of setting is most appropriate?
Choices:
1) A personal time-zone preference in user settings 2) An index retention setting 3) A forwarder output setting 4) A data-model acceleration setting
Correct Answer: A personal time-zone preference in user settings
Explanation: User preferences can control display behavior such as the user's time zone without changing the underlying server clock or indexed event timestamps.Page 2
Question 4: You need to �nd failed authentication events in the security index and you know the exact sourcetype. Which search is the most narrowly scoped starting point?
Choices:
1) failure 2) index=security failure 3) sourcetype=auth failure 4) index=security sourcetype=auth failure
Correct Answer: index=security sourcetype=auth failure
Explanation: Specifying both index and sourcetype narrows the data set early, and adding the failure term further restricts matching events.
Question 5: What is the primary purpose of the time range picker when running a
Splunk search?
Choices:
1) To choose which �elds are extracted 2) To limit the events considered by event time 3) To set index retention 4) To change the search head time zone for every user
Correct Answer: To limit the events considered by event time
Explanation: The time range picker constrains the search to a selected event-time window, which can greatly reduce the amount of data scanned.Page 3