SPLK-1003 · Question #72
Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678. Which configuration file and stanza pair will mask possible SSNs in…
The correct answer is D. transforms.conf. transforms.conf contains the masking stanzas using SEDCMD or REGEX/FORMAT pairs that redact or anonymize PII such as Social Security Numbers in log events.
Question
Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678. Which configuration file and stanza pair will mask possible SSNs in the log events?
Options
- Aprops.conf
- Bprops.conf
- Ctransforms.conf
- Dtransforms.conf
How the community answered
(23 responses)- A13% (3)
- B9% (2)
- C4% (1)
- D74% (17)
Why each option
transforms.conf contains the masking stanzas using SEDCMD or REGEX/FORMAT pairs that redact or anonymize PII such as Social Security Numbers in log events.
props.conf can reference a transforms stanza to invoke masking, but it does not contain the masking regex or replacement logic itself.
props.conf serves the same role as choice A - it references transforms but does not define the masking operation.
This choice represents transforms.conf with an incorrect or incomplete stanza configuration; the correct answer D specifies the proper stanza type (e.g., SEDCMD or REGEX with DEST_KEY) required for masking.
transforms.conf is where the actual masking logic is defined; a stanza using SEDCMD with a regex matching the SSN pattern (e.g., \d{3}-\d{2}-\d{4}) rewrites the _raw field to replace SSNs with a placeholder. The stanza is referenced from props.conf via a TRANSFORMS- setting, but the masking rule itself resides in transforms.conf.
Concept tested: PII masking using transforms.conf SEDCMD stanza
Source: https://docs.splunk.com/Documentation/Splunk/latest/Security/Anonymizedata
Topics
Community Discussion
No community discussion yet for this question.