An admin is editing a custom transforms.conf file. The file contains two stanzas both named '[my_redirect]'. The first stanza sets DEST_KEY = 'MetaData:Index' and FORMAT = 'index_a'. The second stanza sets DEST_KEY = 'MetaData:Index' and FORMAT = 'index_b'. When a search-time transform uses this stanza, which index will events be routed to?

An error will be logged and events will not be routed

Events will be routed to both indexes

A user has a custom app 'user_app' with a props.conf in its local directory that sets a custom sourcetype's TRUNCATE to 1000. The same app has a props.conf in its default directory that sets TRUNCATE to 500. What is the effective TRUNCATE value for this sourcetype?

The system default will be used

In Splunk, if two apps both define a setting in their respective inputs.conf files, which app's setting is used?

The app whose name comes last alphabetically

The app that was installed first

The app with the highest priority setting in its metadata

The app with the most recent version

What is the purpose of default configuration files in Splunk?

They contain settings that cannot be changed

They are used only for troubleshooting and not applied

They provide baseline settings that can be overridden by custom configurations

They are automatically generated and have no effect

In Splunk, when the same setting is defined in multiple configuration files at different levels, which order does Splunk use to apply them, from lowest to highest precedence?

System-level, then app-level, then user-level

System-level, then user-level, then app-level

App-level, then system-level, then user-level

User-level, then app-level, then system-level

SplunkCloud Certified Admin

Domain 4Objective 2

Review Configuration File Precedence CLOUD-CERTIFIED-ADMIN Practice Questions (Page 1)

Part of the Splunk Configuration Files domain, which accounts for 5% of the CLOUD-CERTIFIED-ADMIN exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~2–3 in this domain), expect 1–1 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

7concepts

5%of the exam

Questions 1–5

1application · easy
An admin is editing a custom transforms.conf file. The file contains two stanzas both named '[my_redirect]'. The first stanza sets DEST_KEY = 'MetaData:Index' and FORMAT = 'index_a'. The second stanza sets DEST_KEY = 'MetaData:Index' and FORMAT = 'index_b'. When a search-time transform uses this stanza, which index will events be routed to?
Select an answer first
2application · easy
A user has a custom app 'user_app' with a props.conf in its local directory that sets a custom sourcetype's TRUNCATE to 1000. The same app has a props.conf in its default directory that sets TRUNCATE to 500. What is the effective TRUNCATE value for this sourcetype?
Select an answer first
3foundation · easy
In Splunk, if two apps both define a setting in their respective inputs.conf files, which app's setting is used?
Select an answer first
4foundation · easy
What is the purpose of default configuration files in Splunk?
Select an answer first
5foundation · easy
In Splunk, when the same setting is defined in multiple configuration files at different levels, which order does Splunk use to apply them, from lowest to highest precedence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-CERTIFIED-ADMIN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CLOUD-CERTIFIED-ADMIN” is a trademark of its owner, used for identification only.