A company is sending application logs to Splunk Cloud via a heavy forwarder. The logs contain sensitive data that must be masked before indexing. The administrator needs to ensure the masking is applied consistently. What should the administrator do?

Use the `sed` command in a search to replace the sensitive data.

Use a search-time field extraction to mask the data in all searches.

Configure a transforms.conf rule on the heavy forwarder to mask the sensitive data before forwarding.

Ask Splunk support to configure masking on the indexer.

What is the administrator's role in managing apps and add-ons in Splunk Cloud?

Configuring the underlying operating system for apps

Deleting apps that are not used by the organization

Installing and updating apps from Splunkbase

Developing all apps from scratch for the organization

A company is sending firewall logs to Splunk Cloud via a universal forwarder. The logs are arriving, but the event timestamps are incorrect because the firewall uses a non-standard timestamp format. The administrator needs to ensure events are indexed with the correct time. What should the administrator do?

Configure a timestamp extraction rule in the props.conf on the forwarder and transform in transforms.conf to parse the custom timestamp.

Submit a support ticket to Splunk to have the timestamp extraction rule applied on the indexer.

Change the firewall's log format to ISO 8601 and then re-upload the logs manually.

Use the `collect` command in a search to re-index the data with the correct timestamp.

A Splunk Cloud administrator is responsible for monitoring the health of the environment. They want to be alerted if the license usage exceeds 80% of the daily quota. Which feature should the administrator use to set up this alert?

Create a saved search that runs on the `_internal` index and set an alert condition on the license usage data.

Create a data model for license usage and enable acceleration.

Use the Monitoring Console to view license usage and manually check it daily.

Configure an alert on the `main` index for any event containing 'license'.

A Splunk Cloud administrator is managing a multi-team environment. The security team needs to see all data, the operations team needs to see only their own logs, and the management team needs to see dashboards but not raw data. The administrator needs to design a role structure that meets these requirements with the least administrative overhead. What should the administrator do?

Create one custom role with all capabilities and then use index restrictions to limit access.

Assign the security team the `admin` role, operations the `power` role, and management the `user` role.

Use search-time field masking to hide raw data from management and rely on the `user` role for operations.

Create three custom roles: one with `search` and `list_indexes` for security, one with index restrictions for operations, and one with `search` but no `view_rawdata` for management.

SplunkCloud Certified Admin

Domain 1Objective 2

Describe Tasks Managed by the Splunk Cloud Administrator CLOUD-CERTIFIED-ADMIN Practice Questions (Page 6)

Part of the Splunk Cloud Overview domain, which accounts for 5% of the CLOUD-CERTIFIED-ADMIN exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~2–3 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

7concepts

5%of the exam

Questions 26–30

26application · medium
A company is sending application logs to Splunk Cloud via a heavy forwarder. The logs contain sensitive data that must be masked before indexing. The administrator needs to ensure the masking is applied consistently. What should the administrator do?
Select an answer first
27foundation · easy
What is the administrator's role in managing apps and add-ons in Splunk Cloud?
Select an answer first
28application · medium
A company is sending firewall logs to Splunk Cloud via a universal forwarder. The logs are arriving, but the event timestamps are incorrect because the firewall uses a non-standard timestamp format. The administrator needs to ensure events are indexed with the correct time. What should the administrator do?
Select an answer first
29application · medium
A Splunk Cloud administrator is responsible for monitoring the health of the environment. They want to be alerted if the license usage exceeds 80% of the daily quota. Which feature should the administrator use to set up this alert?
Select an answer first
30expert · hard
A Splunk Cloud administrator is managing a multi-team environment. The security team needs to see all data, the operations team needs to see only their own logs, and the management team needs to see dashboards but not raw data. The administrator needs to design a role structure that meets these requirements with the least administrative overhead. What should the administrator do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CLOUD-CERTIFIED-ADMIN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CLOUD-CERTIFIED-ADMIN” is a trademark of its owner, used for identification only.

Describe Tasks Managed by the Splunk Cloud Administrator CLOUD-CERTIFIED-ADMIN Practice Questions (Page 6)

Questions 26–30

A company is sending application logs to Splunk Cloud via a heavy forwarder. The logs contain sensitive data that must be masked before indexing. The administrator needs to ensure the masking is applied consistently. What should the administrator do?

What is the administrator's role in managing apps and add-ons in Splunk Cloud?

A Splunk Cloud administrator is responsible for monitoring the health of the environment. They want to be alerted if the license usage exceeds 80% of the daily quota. Which feature should the administrator use to set up this alert?

Keep studying — Splunk Cloud Overview