Create Network (TCP and UDP) Inputs CLOUD-CERTIFIED-ADMIN Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A Splunk admin is configuring inputs for a large environment with multiple devices sending data via TCP and UDP. The admin wants to ensure that data from different devices is stored in different indexes. The devices send data to the same port (e.g., 514) but use different protocols (some TCP, some UDP). What is the most efficient way to route data to different indexes?

   • ACreate separate TCP and UDP inputs on the same port and use transforms to route data based on source IP.
   • BCreate a separate input for each device on a different port.
   • CUse a single TCP input and a single UDP input on the same port, and set the index based on the source type.
   • DCreate a single TCP input on port 514 and a single UDP input on port 514, each with a different index.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When configuring a UDP input in Splunk, which of the following is a key difference compared to a TCP input?

   • AUDP inputs can only receive data from a single source IP address
   • BUDP inputs require a source type to be specified, while TCP inputs do not
   • CUDP inputs require the data to be newline-delimited, while TCP inputs do not
   • DUDP inputs use a connectionless protocol, so Splunk does not maintain a persistent connection
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In Splunk Web, where can you see the status of configured network inputs to verify they are enabled?

   • ASettings > Data inputs > TCP/UDP
   • BSettings > Data inputs > Files & directories
   • CSettings > Indexes > Input status
   • DSettings > Server controls > Input status
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   After configuring a new TCP input on a Splunk Cloud heavy forwarder, the admin wants to confirm that the input is active and receiving data. Which of the following is the most direct way to verify this?

   • ARun a search on the main index for events from the new input.
   • BUse the Splunk CLI command './splunk list tcp'.
   • CCheck the inputs.conf file for the port number.
   • DCheck the internal index for messages from the TcpInputProcessor.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is sending web server logs to Splunk Cloud via TCP. The logs are currently being indexed with the source type 'web:access'. The admin wants to change the source type to 'web:combined' for all data received on this input. What is the most efficient way to make this change?

   • AUse a transform to override the source type to 'web:combined'.
   • BCreate a new TCP input on a different port and update the web server to send to the new port.
   • CChange the index to a new index and set the source type there.
   • DEdit the TCP input configuration and change the source type to 'web:combined'.
   Reveal Solution Discussion Select an answer first