Summer Certification Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: force70

Pass the Splunk Splunk Enterprise Certified Admin SPLK-1003 Questions and answers with CertsForce

Viewing page 7 out of 7 pages
Viewing questions 61-70 out of questions
Questions # 61:

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as

follows: 123-44-5678.

Which configuration file and stanza pair will mask possible SSNs in the log events?

Options:

A.

props.conf[mask-SSN]REX = (?ms)^(.)\ < [SSN > \d{3}-?\d{2}-?(\d{4}.*)$ " FORMAT = $1 < SSN > ###-##-$2KEY = _raw


B.

props.conf[mask-SSN]REGEX = (?ms)^(.)\ < [SSN > \d{3}-?\d{2}-?(\d{4}.*)$ " FORMAT = $1 < SSN > ###-##-$2DEST_KEY = _raw


C.

transforms.conf[mask-SSN]REX = (?ms)^(.)\ < [SSN > \d{3}-?\d{2}-?(\d{4}.*)$ " FORMAT = $1 < SSN > ###-##-$2DEST_KEY = _raw


D.

transforms.conf[mask-SSN]REGEX = (?ms)^(.)\ < [SSN > \d{3}-?\d{2}-?(\d{4}.*)$ " FORMAT = $1 < SSN > ###-##-$2DEST_KEY = _raw


Expert Solution
Questions # 62:

Using the CLI on the forwarder, how could the current forwarder to indexer configuration be viewed?

Options:

A.

splunk btool server list --debug


B.

splunk list forward-indexer


C.

splunk list forward-server


D.

splunk btool indexes list --debug


Expert Solution
Questions # 63:

An admin updates the Role to Group mapping for external authentication. How does the change affect users that are currently logged into Splunk?

Options:

A.

Users will continue to operate under their previous role until the next time they log into Splunk.


B.

Search is disabled until users reauthenticate.


C.

Only newly created user accounts are affected by the role change.


D.

The role update terminates the user’s current session, and they have to log back in.


Expert Solution
Viewing page 7 out of 7 pages
Viewing questions 61-70 out of questions