Mock exam questions

1. Which configuration file in Splunk is responsible for specifying data inputs to be collected and indexed?
   1. inputs.conf
   2. props.conf
   3. transforms.conf
   4. indexes.conf
2. You are a system administrator: how can you control access to specific indexes and resources in Splunk?
   1. By configuring firewall rules on the Splunk servers.
   2. By encrypting the data before indexing it in Splunk.
   3. By setting up authentication mechanisms such as the Lightweight Directory Access Protocol (LDAP) or Security Assertion Markup Language (SAML).
   4. By following Splunk role-based access control (RBAC) and creating a role that can be configured to allow access to specific indexes and resources. Roles in turn can be assigned to users.
3. Which Splunk component is responsible for deploying apps to forwarders?
   1. The deployment server (DS)
   2. The heavy forwarder (HF)
   3. The license manager (LM)
   4. The search head (SH)
4. What is the purpose of a Splunk indexer?
   1. It indexes and stores incoming data for searching and analysis
   2. It...