Configure Forwarders to Be Deployment Clients CLOUD-CERTIFIED-ADMIN Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has a security requirement that forwarders must only communicate with the deployment server over a specific network segment. The forwarders are currently configured to use the deployment server's hostname. The admin needs to ensure that the forwarders use the correct IP address for the deployment server on the secure network. What is the most reliable way to achieve this?

   • ACreate a DNS entry that resolves the deployment server's hostname to the IP address on the secure network.
   • BConfigure the forwarders' hosts file to map the deployment server's hostname to the secure IP address.
   • CUpdate the deploymentclient.conf on each forwarder to use the IP address instead of the hostname.
   • DUse a firewall rule to redirect traffic from the deployment server's hostname to the secure IP address.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A Splunk admin is troubleshooting a universal forwarder that is not receiving configuration updates from the deployment server. The forwarder is listed as 'Connected' in the deployment server UI. The admin checks the forwarder's deploymentclient.conf and sees the correct server URI. What should the admin check next to diagnose the issue?

   • AThe forwarder's splunkd.log for errors related to the deployment client.
   • BThe forwarder's inputs.conf to ensure the app is being monitored.
   • CThe forwarder's outputs.conf to ensure it is sending data to the correct indexer.
   • DThe deployment server's web.conf to verify the management port is correct.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Splunk admin needs to deploy a configuration update to a specific group of forwarders without affecting others. The admin has created a new server class and added the target forwarders to it. The admin then places the updated app in the deployment server's apps directory. What else must the admin do to ensure only the target forwarders receive the update?

   • ARemove the app from the deployment server's apps directory after the update is complete.
   • BEdit the forwarders' deploymentclient.conf to specify the server class name.
   • CAssociate the app with the new server class in the deployment server's UI or via serverclass.conf.
   • DRestart all forwarders in the target group to force them to check in immediately.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Splunk admin is investigating why a universal forwarder is not receiving a new app from the deployment server. The forwarder is configured as a deployment client and shows as 'Connected' in the deployment server UI. The admin checks the forwarder's apps directory and sees the app is not present. What is the most likely reason the app is not being installed?

   • AThe forwarder's deployment client is disabled.
   • BThe forwarder is not sending data to the deployment server.
   • CThe deployment server's management port is blocked by a firewall.
   • DThe app is not associated with a server class that includes this forwarder.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A Splunk admin is troubleshooting a universal forwarder that is not receiving updates. The forwarder is listed as 'Connected' in the deployment server UI. The admin checks the forwarder's splunkd.log and sees the message 'App install failed' for the app. The admin verifies the app is correctly associated with the server class. What is the most likely cause of the install failure?

   • AThe deployment server is not configured to push apps to this forwarder.
   • BThe forwarder's deployment client is disabled.
   • CThe app has a permission issue on the deployment server, preventing the forwarder from downloading it.
   • DThe forwarder does not have enough disk space to install the app.
   Reveal Solution Discussion Select an answer first