SPLK-1003 · Question #45
In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?
The correct answer is D. To ensure that data has not been tampered with for auditing and/or legal purposes. The data integrity check feature in Splunk generates cryptographic hashes (using SHA-256) of the raw data stored in index buckets. These hashes can later be used to verify that the indexed data has not been altered or tampered with - which is critical for compliance, forensic…
Question
In which scenario would a Splunk Administrator want to enable data integrity check when creating an index?
Options
- ATo ensure that hot buckets are still open for writes and have not been forced to roll to a cold state
- BTo ensure that configuration files have not been tampered with for auditing and/or legal purposes
- CTo ensure that user passwords have not been tampered with for auditing and/or legal purposes.
- DTo ensure that data has not been tampered with for auditing and/or legal purposes
How the community answered
(48 responses)- A4% (2)
- C2% (1)
- D94% (45)
Explanation
The data integrity check feature in Splunk generates cryptographic hashes (using SHA-256) of the raw data stored in index buckets. These hashes can later be used to verify that the indexed data has not been altered or tampered with - which is critical for compliance, forensic investigations, and legal admissibility of log data. It does not protect configuration files, user passwords, or bucket roll states. Enabling this feature has a small performance cost, so it should only be enabled when data immutability verification is a regulatory or legal requirement.
Topics
Community Discussion
No community discussion yet for this question.