Describe and Utilize REST APIs. CYBERSECURITY-DEFENSE-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a common use case for automating Splunk administration with the REST API?

   • ACreating and updating saved searches programmatically
   • BRebooting the Splunk server
   • CManually typing search queries into the Splunk web interface
   • DChanging the Splunk logo on the login page
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which curl command correctly authenticates to the Splunk REST API using basic authentication and retrieves the list of saved searches?

   • Acurl -d 'username=admin&password=password' https://splunk.example.com:8089/services/saved/searches
   • Bcurl -H 'Authorization: Bearer token' https://splunk.example.com:8089/services/saved/searches
   • Ccurl -u admin:password https://splunk.example.com:8089/services/saved/searches
   • Dcurl -X POST https://admin:password@splunk.example.com:8089/services/saved/searches
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst needs to automate the retrieval of a list of all saved searches from a Splunk instance using the REST API. The analyst has a username and password but wants to avoid embedding credentials in the script. Which approach should the analyst use?

   • AUse the 'X-Auth-Token' header with the username and password.
   • BUse basic authentication with the username and password in the Authorization header for each request.
   • CGenerate a Splunk authentication token and use it in the Authorization header for the API calls.
   • DUse the session key from the login endpoint and pass it as a query parameter.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When a Splunk REST API response includes a 'messages' field with an error, what is the best practice for handling it in an automated script?

   • AIgnore the messages field and continue processing the response
   • BLog the error and exit the script
   • CRetry the request indefinitely until it succeeds
   • DCheck the HTTP status code and the messages field, then handle the error appropriately
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A Splunk admin needs to automate the creation of a new index and then immediately add a data input that writes to that index. The admin wants to ensure the index is created before the data input is added. Which approach should the admin take?

   • ASend the data input request first, then the index creation request.
   • BSend both requests simultaneously using asynchronous calls.
   • CSend a POST request to create the index, then wait for a 201 response before sending the POST request for the data input.
   • DUse a single request that creates both the index and the data input.
   Reveal Solution Discussion Select an answer first