Use the HTTP Event Collector (HEC) to Get Data into Splunk CLOUD-CERTIFIED-ADMIN Practice Questions (Page 7)

Questions 31–34

1. 31expert · hard

   A security team is concerned about a HEC token being compromised. They want to implement a solution that allows them to revoke access quickly without regenerating the token and updating all client applications. What is the most effective approach?

   • AChange the token's allowed index to a non-existent index.
   • BUse a firewall rule to block the token's source IP.
   • CDisable the token in Splunk Web until the threat is mitigated.
   • DRegenerate the token and update all clients immediately.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which field is required in a JSON-formatted HEC event?

   • Ahost
   • Bindex
   • Cevent
   • Dtime
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is evaluating different methods to send data to Splunk Cloud. They have a custom application that generates JSON events and needs a simple, direct HTTPS API to send them. They do not want to install a forwarder. Which method should they choose?

   • AUniversal Forwarder
   • BTCP input
   • CSyslog input
   • DHTTP Event Collector (HEC)
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A team is sending a large batch of events to HEC in a single POST request. They are experiencing timeouts and some events are being lost. They want to improve reliability. What is the best approach?

   • ACompress the batch with gzip and send it in one request.
   • BDisable HEC acknowledgments to reduce overhead.
   • CSplit the batch into smaller chunks and send them in multiple requests.
   • DSend the entire batch in one request and increase the client timeout.
   Reveal Solution Discussion Select an answer first