3.5 Configure Splunk to Ingest Cloud Logging and Monitoring Data from Other Security Solutions 350-701 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is ingesting logs from a custom application into Splunk. The logs are in JSON format, but the JSON is nested. The team wants to extract a specific nested field, such as 'user.email', as a top-level field. What is the best approach?

   • AUse a regex in transforms.conf to manually extract the nested field.
   • BUse a JSON extraction in props.conf to automatically extract all fields, including nested ones.
   • CUse the 'spath' command in every search to extract the nested field.
   • DUse a lookup table to map the JSON path to a field name.
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   Which Splunk input type is most appropriate for ingesting log data from a cloud service that writes logs to a file on a virtual machine?

   • AMonitor input
   • BHTTP Event Collector (HEC)
   • CScripted input
   • DTCP input
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company wants to ingest Google Cloud Logging data into Splunk. They have decided to use the Google Cloud Pub/Sub push subscription to send logs to a Splunk HTTP Event Collector (HEC) endpoint. However, the logs are not being received. What is the most likely cause?

   • AThe Pub/Sub push subscription is not configured with the correct HEC endpoint URL and token.
   • BThe Pub/Sub topic is not configured to export logs.
   • CThe Google Cloud Logging API is not enabled.
   • DThe Splunk HEC token does not have the 'search' capability.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team is ingesting AWS CloudTrail logs into Splunk using the Splunk Add-on for AWS. The logs are being collected, but the timestamps are incorrect — they appear as the time of ingestion rather than the actual event time. What is the most likely cause?

   • AThe IAM role used by the add-on lacks the 'cloudtrail:GetEventTime' permission.
   • BThe Splunk indexer's clock is set to UTC while the CloudTrail logs are in local time.
   • CThe CloudTrail logs are not enabled for the specific region.
   • DThe add-on is not configured to use the CloudTrail event time as the event timestamp.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company ingests AWS CloudTrail logs into Splunk using the Splunk Add-on for AWS. The logs are being collected, but the events are showing the wrong sourcetype. The team expects the sourcetype to be 'aws:cloudtrail', but it appears as 'aws:cloudtrail:json'. What is the most likely cause?

   • AThe Splunk indexer is configured to override the sourcetype for all AWS inputs.
   • BThe add-on is misconfigured and is using the wrong sourcetype.
   • CThe IAM role used by the add-on does not have permission to read the CloudTrail logs.
   • DThe CloudTrail logs are in JSON format, and the add-on assigns a different sourcetype for JSON logs.
   Reveal Solution Discussion Select an answer first