SPLK-1003 無料問題集「Splunk Enterprise Certified Admin」

（A）[distributedSearch:Paris] default = false servers = server1:8089; server2:8089

（B）[searchGroup:Paris] default = false servers = server1:9997, server2:9997

（C）[searchGroup:Paris] default = false servers = server1:8089, server2:8089

（D）[distributedSearch:Paris] default = false servers = server1, server2

（A）Search heads

（B）Search peers

（C）Universal Forwarders

（D）Heavy Forwarders

（A）option A

（B）Option D

（C）Option B

（D）Option C

（A）1. Request Login
2. Connect to SAML server
3 Duo MFA
4 Create User session
5 Authentication Granted 6. Log into Splunk

（B）1. Request Login 2 Duo MFA
3. Authentication Granted 4 Connect to SAML server
5. Log into Splunk
6. Create User session

（C）1 Request Login
2 Check authentication / group mapping
3 Authentication Granted
4. Duo MFA
5. Create User session
6. Log into Splunk

（D）1 Request Login 2 Duo MFA
3. Check authentication / group mapping
4 Create User session
5. Authentication Granted
6 Log into Splunk

（A）[source: : /var/log/ splunk]
CHARSET = BIG5

（B）[index: :main]
CHARSET = BIG5

（C）[sourcetype: : son]
CHARSET = BIG5

（D）[host: : server. splunk. com]
CHARSET = BIG5

（A）Full Name

（B）Password

（C）Default app

（D）Username

（A）Indexing

（B）Parsing

（C）Input

（D）Search

（A）A classification that determines if a Splunk server can remotely control another Splunk server.

（B）A classification that determines what indexes a user can search.

（C）A classification that determines what functions a Splunk server controls.

（D）A classification that determines what capabilities a user has.

（A）Set SPLUNK_AUTHENTICATION=false in splunk-launch.conf

（B）Remove the $SPLUNK_HOME/etc/passwd file

（C）Set nativeAuthentication=false in authentication.conf

（D）Create an empty $SPLUNK_HOME/etc/passwd file

（A）When extracting fields for ingested data.

（B）When previewing the data before searching.

（C）When validating the parsing of data.

（D）When reviewing data on the source host.