Which default Splunk role could be assigned to provide users with the following capabilities?
Create saved searches
Edit shared objects and alerts
Not allowed to create custom roles

• A.admin
• B.power
• C.user
• D.splunk-system-role

Comment: *

Name: *

Email: *

Verification: *

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678.
Which configuration file and stanza pair will mask possible SSNs in the log events?
props.conf

• A.[mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  KEY = _raw
  props.conf
• B.[mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
  transforms.conf
• C.[mask-SSN]
  REX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw
  transforms.conf
• D.[mask-SSN]
  REGEX = (?ms)^(.)\<[SSN>\d{3}-?\d{2}-?(\d{4}.*)$"
  FORMAT = $1<SSN>###-##-$2
  DEST_KEY = _raw

Comment: *

Name: *

Email: *

Verification: *

A Universal Forwarder is collecting two separate sources of data (A,B). Source A is being routed through a Heavy Forwarder and then to an indexer. Source B is being routed directly to the indexer. Both sets of data require the masking of raw text strings before being written to disk. What does the administrator need to do to ensure that the masking takes place successfully?

• A.Make sure that props . conf and transforms . conf are both present on the in-dexer and the search head.
• B.For source A, make sure that props . conf is in place on the indexer; and for source B, make sure transforms . conf is present on the Heavy Forwarder.
• C.Make sure that props . conf and transforms . conf are both present on the Universal Forwarder.
• D.Place both props . conf and transforms . conf on the Heavy Forwarder for source A, and place both props . conf and transforms . conf on the indexer for source B.

Comment: *

Name: *

Email: *

Verification: *

The CLI command splunk add forward-server indexer:<receiving-port> will create stanza(s) in which configuration file?

• A.inputs.conf
• B.indexes.conf
• C.outputs.conf
• D.servers.conf

Comment: *

Name: *

Email: *

Verification: *

In case of a conflict between a whitelist and a blacklist input setting, which one is used?

• A.Blacklist
• B.Whitelist
• C.They cancel each other out.
• D.Whichever is entered into the configuration first.

Comment: *

Name: *

Email: *

Verification: *