nerdexam
Splunk

SPLK-1003 · Question #72

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678. Which configuration file and stanza pair will mask possible SSNs in…

The correct answer is D. transforms.conf. transforms.conf contains the masking stanzas using SEDCMD or REGEX/FORMAT pairs that redact or anonymize PII such as Social Security Numbers in log events.

Configuration Files

Question

Social Security Numbers (PII) data is found in log events, which is against company policy. SSN format is as follows: 123-44-5678. Which configuration file and stanza pair will mask possible SSNs in the log events?

Options

  • Aprops.conf
  • Bprops.conf
  • Ctransforms.conf
  • Dtransforms.conf

How the community answered

(23 responses)
  • A
    13% (3)
  • B
    9% (2)
  • C
    4% (1)
  • D
    74% (17)

Why each option

transforms.conf contains the masking stanzas using SEDCMD or REGEX/FORMAT pairs that redact or anonymize PII such as Social Security Numbers in log events.

Aprops.conf

props.conf can reference a transforms stanza to invoke masking, but it does not contain the masking regex or replacement logic itself.

Bprops.conf

props.conf serves the same role as choice A - it references transforms but does not define the masking operation.

Ctransforms.conf

This choice represents transforms.conf with an incorrect or incomplete stanza configuration; the correct answer D specifies the proper stanza type (e.g., SEDCMD or REGEX with DEST_KEY) required for masking.

Dtransforms.confCorrect

transforms.conf is where the actual masking logic is defined; a stanza using SEDCMD with a regex matching the SSN pattern (e.g., \d{3}-\d{2}-\d{4}) rewrites the _raw field to replace SSNs with a placeholder. The stanza is referenced from props.conf via a TRANSFORMS- setting, but the masking rule itself resides in transforms.conf.

Concept tested: PII masking using transforms.conf SEDCMD stanza

Source: https://docs.splunk.com/Documentation/Splunk/latest/Security/Anonymizedata

Topics

#Data Masking#PII#transforms.conf#Configuration Files

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice