Identify Windows Input Types and Uses CLOUD-CERTIFIED-ADMIN Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A Splunk admin is configuring inputs for a Windows server that hosts a web application. The admin needs to collect IIS logs (stored in C:\inetpub\logs\LogFiles) and Windows Application event logs. The admin wants to ensure that the IIS logs are indexed with a source type of 'iis' and the event logs with 'WinEventLog:Application'. What should the admin do?

   • AConfigure an event log input for the Application log and a performance monitor input for IIS logs
   • BConfigure a registry input for the IIS configuration and an event log input for the Application log
   • CConfigure a file system input for the IIS log directory with source type 'iis', and an event log input for the Application log with source type 'WinEventLog:Application'
   • DConfigure a single file system input for both the IIS logs and the Application event log, with source type 'iis'
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the purpose of a Windows registry input in Splunk?

   • ATo monitor registry keys and values for changes
   • BTo collect event log data
   • CTo collect performance counters
   • DTo monitor files and directories
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst needs to detect failed login attempts and account lockouts across 200 Windows servers. The data must be searchable in Splunk with the original host name preserved. What should the admin configure?

   • AA Windows performance monitor input for the Security log, with the source type set to WinEventLog
   • BA Windows event log input for the Security log, with the host field set to the server's name
   • CA Windows registry input monitoring the SAM registry key for changes
   • DA Windows file system input monitoring the C:\Windows\System32\winevt\Logs\Security.evtx file
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Splunk admin needs to collect CPU utilization and available memory from a Windows server every 30 seconds to support capacity planning. The data must be searchable with a source type that distinguishes it from event logs. What should the admin configure?

   • AA Windows performance monitor input with counters \Processor(_Total)\% Processor Time and \Memory\Available MBytes, interval 30, source type Perfmon
   • BA Windows file system input monitoring C:\PerfLogs\ with a 30-second interval
   • CA Windows registry input monitoring HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor
   • DA Windows event log input for the System log with a 30-second polling interval
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A compliance team must detect unauthorized changes to the Windows registry key HKLM\SOFTWARE\MyApp\Config. The admin needs to see the old and new values when a change occurs. What should the admin configure?

   • AA Windows performance monitor input with a registry counter
   • BA Windows file system input monitoring the registry hive file
   • CA Windows registry input monitoring that key with the 'Monitor Subkeys' option enabled
   • DA Windows event log input for the Security log to detect registry changes
   Reveal Solution Discussion Select an answer first