3.5 Configure Splunk to Ingest Cloud Logging and Monitoring Data from Other Security Solutions 350-701 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company wants to ingest Azure Active Directory (Azure AD) logs into Splunk. They have configured the Splunk Add-on for Microsoft Cloud Services to use an Azure AD app registration with the required permissions. However, the add-on is unable to authenticate. What is the most likely cause?

   • AThe client secret for the app registration has expired.
   • BThe app registration does not have the 'User.Read' permission.
   • CThe Azure AD logs are not enabled for the tenant.
   • DThe Splunk add-on requires the Azure AD Premium license.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is ingesting logs from a custom security appliance into Splunk. The logs are in a key-value format, but the keys contain spaces (e.g., 'Source IP=192.168.1.1'). The team wants to extract these as fields. What is the best approach?

   • AUse a regex in transforms.conf to extract the key-value pairs, handling the spaces in the keys.
   • BUse the 'rex' command in every search to extract the fields.
   • CUse a lookup table to map the raw log lines to fields.
   • DUse the built-in key-value extraction in props.conf.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security operations center uses a third-party IDS/IPS that sends alerts via syslog. They want to ingest these alerts into Splunk for correlation with other security data. They have configured a Splunk universal forwarder to send syslog data to the indexer. The data is being received, but the events appear as a single large blob of text with no field extraction. What should they do to properly parse the IDS/IPS alerts?

   • AUse the 'sed' command in props.conf to replace spaces with commas.
   • BInstall and configure the vendor-specific Splunk add-on for the IDS/IPS.
   • CConfigure the universal forwarder to use TCP instead of UDP for syslog.
   • DSet the source type to 'syslog' and rely on Splunk's automatic parsing.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company wants to ingest Azure Monitor logs into Splunk. They have configured the Splunk Add-on for Microsoft Cloud Services to use an Azure event hub. The add-on is receiving data, but the events are not being parsed correctly — the fields are not being extracted. What is the most likely cause?

   • AThe event hub is not configured to use the correct partition key.
   • BThe Azure diagnostic settings are not configured to send the logs in JSON format.
   • CThe add-on is not configured to use the correct sourcetype for the Azure logs.
   • DThe event hub is not in the same region as the Splunk deployment.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company uses a third-party SIEM that sends CEF-formatted logs to Splunk via syslog. The logs are being received, but the field extractions are not working correctly — the event is not being parsed into CEF fields. What should the administrator do to fix this?

   • AInstall the Splunk Add-on for the specific SIEM vendor.
   • BSet the source type to 'cef' in the inputs.conf for the syslog input.
   • CUse a regex in transforms.conf to manually extract each CEF field.
   • DConfigure the syslog input to use TCP instead of UDP.
   Reveal Solution Discussion Select an answer first