A user reports that they are receiving a '401 Unauthorized' error when trying to send data to HEC. They have verified the endpoint URL is correct. What is the most likely cause and solution?

The index does not exist; they should create the index first.

The network firewall is blocking the request; they should check the firewall rules.

The token is disabled or invalid; they should verify the token is enabled and correctly included in the Authorization header.

The event payload is malformed; they should check the JSON syntax.

An admin is creating a new HEC token for a team that sends web server logs. The logs are in a custom format and should be parsed with a specific sourcetype. The team also wants to ensure that if they forget to specify an index in their payload, the events go to a dedicated 'web' index. What should the admin configure on the token?

Set the default host to 'web-server' and the default source to 'access.log'.

Create a new index named 'web' and assign it to the token.

Instruct the team to always include the index and sourcetype in their payload.

Set the default index to 'web' and the default sourcetype to the custom sourcetype.

SplunkCloud Certified Admin

Domain 8Objective 5

Use the HTTP Event Collector (HEC) to Get Data into Splunk CLOUD-CERTIFIED-ADMIN Practice Questions (Page 4)

Part of the Network and Other Inputs domain, which accounts for 10% of the CLOUD-CERTIFIED-ADMIN exam. Splunk does not publish an official question count, but from its 75-minute exam (~30–50 total, ~3–5 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

10%of the exam

Questions 16–20

16foundation · easy
Which protocol is used to secure HEC communications?
Select an answer first
17application · medium
A user reports that they are receiving a '401 Unauthorized' error when trying to send data to HEC. They have verified the endpoint URL is correct. What is the most likely cause and solution?
Select an answer first
18application · medium
An admin is creating a new HEC token for a team that sends web server logs. The logs are in a custom format and should be parsed with a specific sourcetype. The team also wants to ensure that if they forget to specify an index in their payload, the events go to a dedicated 'web' index. What should the admin configure on the token?
Select an answer first
19foundation · easy
Which component is NOT part of the HEC architecture?
Select an answer first
20foundation · easy
What is the primary benefit of sending batched events to HEC?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CLOUD-CERTIFIED-ADMIN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CLOUD-CERTIFIED-ADMIN” is a trademark of its owner, used for identification only.

Use the HTTP Event Collector (HEC) to Get Data into Splunk CLOUD-CERTIFIED-ADMIN Practice Questions (Page 4)

Questions 16–20

Which protocol is used to secure HEC communications?

A user reports that they are receiving a '401 Unauthorized' error when trying to send data to HEC. They have verified the endpoint URL is correct. What is the most likely cause and solution?

Which component is NOT part of the HEC architecture?

What is the primary benefit of sending batched events to HEC?

Keep studying — Network and Other Inputs