Splunk Updated SPLK-2001 Exam Questions and Answers by julian

The correct answer is B, C, and D, because they are all security best practices for Splunk app development. Storing passwords in clear text in .conf files is not a security best practice, because it exposes the passwords to unauthorized access or leakage. Implementing security in software development lifecycle means applying security principles and practices throughout the app development process, from design to deployment. Manually testing application with the controls listed in the OWASP Security Testing Guide helps to identify and mitigate common security risks and vulnerabilities in web applications. Using a dynamic scanner such as OWASP ZAP to scan web application components for vulnerabilities helps to automate the security testing and find potential issues that might be missed by manual testing.

The correct answer is B and C because these are the statements that describe one-shot searches. A one-shot search is a type of search that runs once and returns all the results at once. Option B is correct because a one-shot search can specify csv as an output format, which returns the results as comma-separated values. Option C is correct because a one-shot search streams all the results upon search completion, which means it does not return any partial results while the search is running. Option A is incorrect because a one-shot search can be executed either synchronously or asynchronously, depending on the method used. Option D is incorrect because a one-shot search cannot use auto_cancel to set a timeout limit, as this parameter is only applicable for normal searches. You can find more information about one-shot searches in the Splunk REST API Reference Manual.

 By using visualization drilldown, you can hide or show a panel by clicking on a chart or a table on the same form. Visualization drilldown lets you define a drilldown action that affects a different panel on the same dashboard. You can use the set or unset tokens to control the visibility of the target panel. For more information, see Visualization drilldown.

 The correct answer is B, C, and D because these are the characteristics of an add-on. An add-on is a Splunk app that provides reusable components or technology for other apps. Option B is correct because an add-on occupies a unique namespace within Splunk, which means it has its own app directory and configuration files. Option C is correct because an add-on can depend on other add-ons for correct operation, such as the Common Information Model Add-on. Option D is correct because an add-on contains technology or components that are not intended for reuse by other apps, such as data inputs, field extractions, lookups, and modular inputs. Option A is incorrect because an add-on does not require a navigation file, as it does not have any user interface elements. You can find more information about add-ons in the Splunk Developer Guide.