SplunkCloud Certified Admin
Domain 4Objective 2
Review Configuration File Precedence CLOUD-CERTIFIED-ADMIN Practice Questions (Page 3)
Part of the Splunk Configuration Files domain, which accounts for 5% of the CLOUD-CERTIFIED-ADMIN exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~2–3 in this domain), expect 1–1 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)
19questions here
4free pages
7concepts
5%of the exam
Questions 11–15
- 11
Which Splunk CLI command is used to inspect the effective configuration values after precedence is applied?
Select an answer first - 12
A Splunk Cloud admin has a custom app that defines a props.conf stanza for sourcetype 'my_app'. The stanza sets TRUNCATE = 10000. The admin also has a system-level props.conf that sets TRUNCATE = 5000 for the same sourcetype. Which value will be used?
Select an answer first - 13
An admin has a custom app with two props.conf files in its default directory: 'props.conf' and 'zzz_props.conf'. The 'props.conf' file defines a stanza for sourcetype 'web_access' with the TIME_FORMAT set to '%Y-%m-%d'. The 'zzz_props.conf' file also defines a stanza for 'web_access' but with TIME_FORMAT set to '%d/%b/%Y'. Which TIME_FORMAT will be used for this sourcetype?
Select an answer first - 14
Which of the following correctly describes the precedence of Splunk configuration files from highest to lowest?
Select an answer first - 15
A Splunk Cloud admin has a custom app 'app_x' with a props.conf in its default directory that sets a custom sourcetype's TRUNCATE to 5000. The admin also has a user-level props.conf in the 'search' app's local directory that sets TRUNCATE to 1000 for the same sourcetype. The admin runs 'btool props list --debug' and sees the effective TRUNCATE is 1000. What is the most likely reason?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CLOUD-CERTIFIED-ADMIN” is a trademark of its owner, used for identification only.