Configure a Forwarder to Splunk Cloud CLOUD-CERTIFIED-ADMIN Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company is setting up a universal forwarder to send data to Splunk Cloud. They have a strict security policy that requires mutual TLS (mTLS) for all connections. The admin is configuring the forwarder. What must be done to meet this requirement?

   • ASet ssl = true and rely on the server certificate only.
   • BConfigure the forwarder with a client certificate and ensure the Splunk Cloud endpoint is configured to request it.
   • CUse a VPN instead of mTLS.
   • DUse a heavy forwarder because universal forwarders do not support mTLS.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A Splunk Cloud admin is configuring a universal forwarder to send data to two indexers for load balancing. The admin wants to ensure that if one indexer is down, the forwarder sends data to the other indexer without data loss. What is the correct configuration?

   • AUse a heavy forwarder to buffer data and send to both indexers.
   • BSet the forwarder to use a single indexer and rely on Splunk Cloud to replicate data.
   • CConfigure two separate tcpout stanzas, one for each indexer, and set the forwarder to use both.
   • DConfigure a tcpout group with both indexers and set autoLB = true.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the purpose of configuring failover in outputs.conf for Splunk Cloud?

   • ATo encrypt data in transit
   • BTo automatically switch to a backup indexer if the primary indexer fails
   • CTo reduce the amount of data sent to the indexer
   • DTo ensure data is sent to multiple indexers simultaneously
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is deploying a universal forwarder on a Windows server to send Windows Event Logs to Splunk Cloud. The forwarder is installed and the inputs.conf is configured to monitor the Security log. However, the data is not appearing in Splunk Cloud. The admin verifies that the forwarder service is running and that the network path to the Splunk Cloud inputs endpoint is open. What is the most likely cause of the issue?

   • AThe forwarder needs a heavy forwarder to send Windows Event Logs to Splunk Cloud.
   • BThe outputs.conf is not configured with the correct Splunk Cloud indexer endpoint and SSL settings.
   • CThe forwarder is not running as an administrator, so it cannot read the Security log.
   • DThe inputs.conf is using the wrong stanza header for Windows Event Logs.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is configuring a universal forwarder to send data to Splunk Cloud. The admin wants to ensure that the forwarder verifies the Splunk Cloud server's certificate to prevent man-in-the-middle attacks. What setting should be enabled in outputs.conf?

   • Assl = true
   • BclientCert = /path/to/cert.pem
   • CsslVerifyServerCert = true
   • DsslVerifyServerCert = false
   Reveal Solution Discussion Select an answer first