Describe Tasks Managed by the Splunk Cloud Administrator CLOUD-CERTIFIED-ADMIN Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the role of a Splunk Cloud administrator in managing data inputs?

   • ACreating user accounts for data sources
   • BWriting all search queries for the data
   • CConfiguring forwarders to send data to Splunk Cloud
   • DManaging the physical storage of the data
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A Splunk Cloud administrator needs to grant a contractor access to a specific app for 30 days. The contractor should only be able to use that app and not see other apps or data. What is the most efficient way to set this up?

   • ACreate a role with access to only that app, assign the contractor to the role, and set an account expiration date.
   • BCreate a new user and manually delete the account after 30 days.
   • CAssign the contractor the `power` role and restrict the app via the user's default app setting.
   • DUse the same user account as another contractor and share the password.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which task is typically part of a Splunk Cloud administrator's routine operational duties?

   • ADeveloping new Splunk features for the platform
   • BManaging the physical servers that host Splunk Cloud
   • CMonitoring the health of the Splunk Cloud environment
   • DSetting up the company's local network infrastructure
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A Splunk Cloud administrator is onboarding a new analytics team. The team needs to search only the `web` index, but they must not be able to edit saved searches or view other indexes. The administrator wants to grant the least privilege necessary. Which approach should the administrator take?

   • ACreate a custom role with the `search` capability, assign it to the `web` index via an index restriction, and add the team members to that role.
   • BCreate a new role with the `search` capability and then add the team to the `power` role as well.
   • CCreate a new role with the `search` capability and set the role's default app to the `web` index.
   • DAssign the team the built-in `user` role and then edit the role's index restrictions to only include `web`.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A Splunk Cloud administrator is planning to onboard data from a new application. The application generates high-volume logs that are not time-sensitive. The administrator wants to minimize the impact on license usage while ensuring the data is available for search. Which approach should the administrator take?

   • AConfigure the forwarder to use a longer time interval for reading the logs and set the index to a lower priority.
   • BUse a heavy forwarder to filter and aggregate the logs before sending them to Splunk Cloud.
   • CUse a universal forwarder to send raw logs and then use a data model to accelerate searches.
   • DSend all logs to Splunk Cloud and rely on search-time filtering to reduce the amount of data searched.
   Reveal Solution Discussion Select an answer first