Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?
props.conf

• A.[mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  KEY = _raw
  props.conf
• B.[mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
  transforms.conf
• C.[mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
  transforms.conf
• D.[mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw

Comment: *

Name: *

Email: *

Verification: *

User role inheritance allows what to be inherited from the parent role? (select all that apply)

• A.Parents
• B.Capabilities
• C.Search history
• D.Index access

Comment: *

Name: *

Email: *

Verification: *

When using a directory monitor input, specific source types can be selectively overridden using which configuration file?

• A.sourcetypes . conf
• B.trans forms . conf
• C.outputs . conf
• D.props . conf

Comment: *

Name: *

Email: *

Verification: *

Which scenario is applicable given the stanzas in authentication.conf below?
[authentication]
externalTwoFactorAuthVendor = Duo
externalTwoFactorAuthSettings = duoMFA
[duoMFA]
integrationKey = aGFwcHliaXJ0aGRheU1pZGR5
secretKey = YXVzdHJhaWxpYW5Gb3JHcmVw
applicationKey = c3BsaW5raW5ndGhlcGx1bWJ1c3NpbmN1OTU
apiHostname = 466993018.duosecurity.com
failOpen = True
timeout = 60

• A.If Splunk cannot connect to the multifactor authentication provider, all logins will be denied.
• B.Multifactor authentication is required to log into the host operating system.
• C.The secretKey does not need to be protected since multifactor authentication is turned on.
• D.If Splunk cannot connect to the multifactor authentication provider, authentications will be successful without completing a multifactor challenge.

Comment: *

Name: *

Email: *

Verification: *

When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

• A.Irregular expression
• B.Wildcard-only expression
• C.Slash notation
• D.Regular expression

Comment: *

Name: *

Email: *

Verification: *