When both a whitelist and a blacklist are configured for a monitor input, what happens?

Only files matching both the whitelist and blacklist are included

Files matching the blacklist are included, and files matching the whitelist are excluded

The whitelist and blacklist are ignored

Files matching the whitelist are included, and files matching the blacklist are excluded

What is the purpose of configuring file rotation handling for a monitor input?

To avoid data loss or duplication when files are rotated or renamed

To filter out rotated files from being monitored

To specify the index for the rotated files

To set the source type for the rotated files

What is the purpose of using props.conf to override monitor input settings?

To configure the number of threads used for reading files

To set source type, index, and other properties for data from a monitor input

To define which files are monitored by the input

To set the character encoding for the input

Which of the following methods can be used to apply optional settings for a monitor input?

Through Splunk Web UI or by editing inputs.conf

Through the search bar using the input command

A Splunk admin is configuring a monitor input for a directory that contains both application logs and system audit logs. The application logs are written to files ending in `.log`, while the audit logs are written to files ending in `.audit`. The admin wants to index only the application logs and skip any audit files. Which optional setting should be configured in the monitor input to achieve this?

Set the `host` setting to extract the hostname from the audit file path.

Set `ignoreOlderThan` to a value that excludes audit files based on their last modified time.

Set the `index` setting to a dedicated index for audit logs.

Configure a `whitelist` with the pattern `*.log` in the monitor input.

SplunkCloud Certified Admin

Domain 7Objective 3

Use Optional Settings for Monitor Inputs CLOUD-CERTIFIED-ADMIN Practice Questions (Page 2)

Part of the Monitor Inputs domain, which accounts for 15% of the CLOUD-CERTIFIED-ADMIN exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~5–8 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

18concepts

15%of the exam

18 Concepts in This Objective

Monitor input optional settings overview
Setting the source type for monitor inputs
Setting the host for monitor inputs
Setting the index for monitor inputs
Configuring the sourcetype and index via props.conf
Using whitelist and blacklist filters
Setting the character set for monitor inputs
Configuring the maximum event size
Setting the time before a file is considered complete
Using the CRC table to track file offsets
Configuring the seek pointer for monitor inputs
Handling file rotation and renaming
Setting the number of threads for reading files
Configuring the read timeout
Using the 'ignoreOlderThan' setting
Setting the 'followTail' option
Configuring the 'crcSalt' setting
Applying optional settings via the UI and inputs.conf

Questions 6–10

6foundation · easy
When both a whitelist and a blacklist are configured for a monitor input, what happens?
Select an answer first
7foundation · easy
What is the purpose of configuring file rotation handling for a monitor input?
Select an answer first
8foundation · easy
What is the purpose of using props.conf to override monitor input settings?
Select an answer first
9foundation · easy
Which of the following methods can be used to apply optional settings for a monitor input?
Select an answer first
10application · medium
A Splunk admin is configuring a monitor input for a directory that contains both application logs and system audit logs. The application logs are written to files ending in `.log`, while the audit logs are written to files ending in `.audit`. The admin wants to index only the application logs and skip any audit files. Which optional setting should be configured in the monitor input to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-CERTIFIED-ADMIN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CLOUD-CERTIFIED-ADMIN” is a trademark of its owner, used for identification only.