Configure a Forwarder to Splunk Cloud CLOUD-CERTIFIED-ADMIN Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In inputs.conf, which stanza is used to monitor a file or directory for new data?

   • A[file:///var/log/app.log]
   • B[input:///var/log/app.log]
   • C[watch:///var/log/app.log]
   • D[monitor:///var/log/app.log]
   Reveal Solution Discussion Select an answer first
2. 2application · easy

   A team needs to forward data from a server that also runs a Splunk search head. They want to minimize resource usage on this server while still sending data to Splunk Cloud. Which forwarder type should they use?

   • AUniversal forwarder
   • BIndexer forwarder
   • CLight forwarder
   • DHeavy forwarder
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An admin notices that a universal forwarder is not sending data to Splunk Cloud. The forwarder service is running, and the admin can ping the Splunk Cloud endpoint. What is the next best step to troubleshoot the issue?

   • ACheck the firewall on the forwarder's network.
   • BReinstall the forwarder.
   • CCheck the forwarder's splunkd.log for errors related to connection or SSL.
   • DRestart the forwarder service immediately.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization has 200 universal forwarders deployed across multiple sites. They need to push a new app that configures a specific file input to all forwarders. The admin wants to manage this centrally without manually editing each forwarder. What should the admin do?

   • AConfigure the forwarders to use a heavy forwarder as an intermediate aggregator.
   • BManually copy the app to each forwarder's etc/apps directory.
   • CUse the Splunk Cloud web UI to push the app directly to each forwarder.
   • DCreate the app and deploy it via a deployment server.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company requires that all data sent from their forwarders to Splunk Cloud be encrypted in transit. They are configuring a new universal forwarder. What must they ensure in the outputs.conf configuration?

   • AUse a heavy forwarder to encrypt data before sending.
   • BSet ssl = false and rely on the VPN for encryption.
   • CSet the indexer endpoint to use port 8089.
   • DSet ssl = true and use the correct certificate authority for the Splunk Cloud endpoint.
   Reveal Solution Discussion Select an answer first