Use the HTTP Event Collector (HEC) to Get Data into Splunk CLOUD-CERTIFIED-ADMIN Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A developer is sending events to HEC and receiving a '400 Bad Request' error with the message 'Data is not in the expected format'. The developer is sending a JSON payload with an 'event' field. What is the most likely cause of this error?

   • AThe event size exceeds the maximum allowed size.
   • BThe token is not enabled.
   • CThe JSON payload is malformed (e.g., missing a closing brace or comma).
   • DThe 'time' field is in the wrong format.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An admin is configuring HEC in Splunk Cloud. They want to allow only a specific application to send data to the 'security' index, while other applications using HEC should not be able to send to that index. What is the most appropriate configuration?

   • ACreate a single HEC token with the 'security' index as the default and share it with all applications.
   • BUse a firewall rule to restrict the application's IP address to the HEC endpoint.
   • CCreate a dedicated HEC token for the application and set the allowed index to 'security' in the token settings.
   • DConfigure the 'security' index to only accept data from a specific sourcetype.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A team is sending high-volume data to HEC. They are experiencing intermittent '400 Bad Request' errors. The error message indicates 'Invalid index'. The team has verified that the index exists and the token has permission to write to it. What is the most likely cause?

   • AThe payload is missing the 'event' field.
   • BThe events are being sent to the wrong HEC endpoint URL.
   • CThe token is being shared and has reached its rate limit.
   • DThe index name in the payload is case-sensitive and does not match the actual index name.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A custom application sends critical audit events to Splunk Cloud HEC. The developer notices that occasionally the HTTP response is '503 Service Unavailable'. The events are not appearing in Splunk. What should the application do to ensure these events are not lost?

   • ASwitch to a different HEC token and resend.
   • BRetry with exponential backoff and consider enabling HEC acknowledgments.
   • CLog the error and drop the events to avoid duplicates.
   • DImmediately resend the same payload with the same request body.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which error message is likely if an HEC token is invalid or missing?

   • AHTTP 500 Internal Server Error
   • BHTTP 404 Not Found
   • CHTTP 302 Found
   • DHTTP 401 Unauthorized
   Reveal Solution Discussion Select an answer first