SPLK-1003 · Question #74
Which Splunk configuration file is used to enable data integrity checking?
The correct answer is C. indexes.conf. indexes.conf is the configuration file where data integrity control is enabled, allowing Splunk to verify that indexed data has not been tampered with.
Question
Which Splunk configuration file is used to enable data integrity checking?
Options
- Aprops.conf
- Bglobal.conf
- Cindexes.conf
- Ddata_integrity.conf
How the community answered
(22 responses)- A5% (1)
- C91% (20)
- D5% (1)
Why each option
indexes.conf is the configuration file where data integrity control is enabled, allowing Splunk to verify that indexed data has not been tampered with.
props.conf manages source type parsing properties and field extractions and has no settings related to index-level data integrity.
global.conf is not a standard Splunk configuration file used for data integrity or general global settings in this context.
indexes.conf contains the enableDataIntegrityControl setting within index stanzas; when set to true, Splunk computes and stores cryptographic hashes of raw data slices so that any unauthorized modification of indexed data can be detected.
data_integrity.conf does not exist as a configuration file in Splunk's configuration framework.
Concept tested: Splunk data integrity control via indexes.conf
Source: https://docs.splunk.com/Documentation/Splunk/latest/Security/Dataintegritycontrol
Topics
Community Discussion
No community discussion yet for this question.