Splunk Exam SPLK-1003 Topic 8 Question 91 Discussion

Actual exam question for Splunk's SPLK-1003 exam

Question #: 91
Topic #: 8

[All SPLK-1003 Questions]

Which scenario is applicable given the stanzas in authentication.conf below?

[authentication]

externalTwoFactorAuthVendor = Duo

externalTwoFactorAuthSettings = duoMFA

[duoMFA]

integrationKey = aGFwcHliaXJ0aGRheU1pZGR5

secretKey = YXVzdHJhaWxpYW5Gb3JHcmVw

applicationKey = c3BsaW5raW5ndGhlcGx1bWJ1c3NpbmN1OTU

apiHostname = 466993018.duosecurity.com

failOpen = True

timeout = 60

AIf Splunk cannot connect to the multifactor authentication provider, all logins will be denied.

BMultifactor authentication is required to log into the host operating system.

CThe secretKey does not need to be protected since multifactor authentication is turned on.

DIf Splunk cannot connect to the multifactor authentication provider, authentications will be successful without completing a multifactor challenge.

Show Suggested Answer

Suggested Answer: C

The correct answer is C. /var/log/host_460352847/bar/file/foo.txt.

The monitor stanza in inputs.conf is used to configure Splunk to monitor files and directories for new data. The monitor stanza has the following syntax1:

[monitor://<input path>]

The input path can be a file or a directory, and it can include wildcards (*) and regular expressions. The wildcards match any number of characters, including none, while the regular expressions match patterns of characters. The input path is case-sensitive and must be enclosed in double quotes if it contains spaces1.

In this case, the input path is /var/log//bar/.txt, which means Splunk will monitor any file with the .txt extension that is located in a subdirectory named bar under the /var/log directory. The subdirectory bar can be at any level under the /var/log directory, and the * wildcard will match any characters before or after the bar and .txt parts1.

Therefore, the file /var/log/host_460352847/bar/file/foo.txt will be matched by the monitor stanza, as it meets the criteria. The other files will not be matched, because:

A) /var/log/host_460352847/temp/bar/file/csv/foo.txt has a .csv extension, not a .txt extension.

B) /var/log/host_460352847/bar/foo.txt is not located in a subdirectory under the bar directory, but directly in the bar directory.

D) /var/log/host_460352847/temp/bar/file/foo.txt is located in a subdirectory named file under the bar directory, not directly in the bar directory.

by Julieta at Jun 21, 2024, 06:29 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Vilma

1 months ago

Pfft, this is easy. The answer is clearly D. Splunk is going to let anyone in if it can't reach the MFA provider. What could possibly go wrong?

upvoted 0 times

...

Kimberlie

1 months ago

Haha, I think C is the right answer. Who needs to protect the secret key when you have MFA, am I right? *wink wink*

upvoted 0 times

Dulce

5 days ago

A) If Splunk cannot connect to the multifactor authentication provider, all logins will be denied.

upvoted 0 times

...

2 months ago

I think the answer is A.

upvoted 0 times

...