What is the primary purpose of the HTTP Event Collector (HEC) in Splunk?

To provide a REST API endpoint for sending data over HTTP

To collect log files from local filesystem paths

To enable real-time streaming of data via TCP/UDP

To manage user authentication for Splunk Web

A security team is sending thousands of small JSON events per second from a central log forwarder to Splunk Cloud HEC. They are concerned about network bandwidth and want to reduce the number of HTTP requests. Which approach should they implement?

Increase the token's max upload size and send events as raw text.

Use HTTP GET requests with query parameters to send multiple events.

Send each event as a separate HTTP POST with gzip compression enabled.

Batch multiple events into a single HTTP POST and enable gzip compression.

What is the purpose of indexer acknowledgment in HEC?

To confirm that the indexer has successfully indexed the event

To compress the data before sending

A developer is sending a batch of events to HEC in a single POST request. They want to know if all events were successfully indexed. What is the most reliable way to achieve this?

Enable HEC acknowledgments and use the returned channel and ack IDs to poll for indexing status.

Search Splunk for the events after a short delay.

Check the HTTP response code; a 200 means all events were indexed.

Use a unique sourcetype for each batch and search for it.

A company is setting up HEC to receive data from a remote office over the internet. The security team mandates that all data in transit must be encrypted. What is the minimum configuration required on the HEC endpoint to meet this requirement?

Enable TLS on the HEC endpoint and ensure clients use HTTPS.

Enable HEC and use a token with a strong password.

Use a VPN between the remote office and Splunk Cloud.

Restrict the HEC token to a specific source type.

SplunkCloud Certified Admin

Domain 8Objective 5

Use the HTTP Event Collector (HEC) to Get Data into Splunk CLOUD-CERTIFIED-ADMIN Practice Questions (Page 1)

Part of the Network and Other Inputs domain, which accounts for 10% of the CLOUD-CERTIFIED-ADMIN exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

10%of the exam

Questions 1–5

1foundation · easy
What is the primary purpose of the HTTP Event Collector (HEC) in Splunk?
Select an answer first
2application · medium
A security team is sending thousands of small JSON events per second from a central log forwarder to Splunk Cloud HEC. They are concerned about network bandwidth and want to reduce the number of HTTP requests. Which approach should they implement?
Select an answer first
3foundation · easy
What is the purpose of indexer acknowledgment in HEC?
Select an answer first
4application · medium
A developer is sending a batch of events to HEC in a single POST request. They want to know if all events were successfully indexed. What is the most reliable way to achieve this?
Select an answer first
5application · medium
A company is setting up HEC to receive data from a remote office over the internet. The security team mandates that all data in transit must be encrypted. What is the minimum configuration required on the HEC endpoint to meet this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-CERTIFIED-ADMIN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CLOUD-CERTIFIED-ADMIN” is a trademark of its owner, used for identification only.