Describe Optional Forwarder Settings CLOUD-CERTIFIED-ADMIN Practice Questions (Page 2)

Questions 6–10

1. 6expert · medium

   A forwarder sends data to an indexer. The admin wants to ensure that data is not lost if the indexer is temporarily unavailable. The forwarder has limited disk space. What should the admin configure?

   • ASet the queue to a very large size regardless of disk space.
   • BDisable useACK to avoid filling the queue.
   • CEnable useACK and set the output queue to a size that fits within the available disk space.
   • DEnable compression to reduce the queue size needed.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the first step in configuring SSL certificates for a universal forwarder?

   • AGenerate or obtain a certificate and private key for the forwarder.
   • BSet compressed=true in outputs.conf.
   • CEnable load balancing in outputs.conf.
   • DRestart the forwarder service.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A forwarder sends data to an indexer over a high-latency WAN link. The admin notices that the forwarder's queue frequently fills up, causing data to be dropped. The admin wants to reduce the chance of data loss without changing the network. What should the admin configure?

   • ADisable compression to reduce CPU usage on the forwarder.
   • BDecrease the maxQueueSize to force the forwarder to send more frequently.
   • CSet the output group to use tcp:// instead of ssl:// to reduce overhead.
   • DIncrease the maxQueueSize for the output queue and enable compression.
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   A forwarder sends data to an indexer over a high-latency satellite link. The admin notices that the forwarder's queue fills up and data is dropped. The admin wants to improve reliability. The forwarder has limited CPU. What should the admin configure?

   • AEnable compression to reduce data size.
   • BEnable useACK and increase the maxQueueSize.
   • CDisable useACK to speed up sending.
   • DDecrease the maxQueueSize to reduce memory usage.
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A forwarder is configured to send data to two indexers. The admin wants to send different data to each indexer. For example, web logs to indexer A and firewall logs to indexer B. What should the admin configure?

   • AUse a single output group with both indexers and rely on the indexers to route the data.
   • BConfigure the forwarder to send all data to indexer A and use a heavy forwarder to route to indexer B.
   • CUse props.conf to route data to different indexers based on source type.
   • DCreate two output groups in outputs.conf and use different input stanzas in inputs.conf for each data source.
   Reveal Solution Discussion Select an answer first