A Splunk admin is configuring SSL between a forwarder and an indexer. The indexer's `[splunktcp-ssl://9997]` stanza has `sslVerifyClientCert = true`. The forwarder's outputs.conf has `sslEnabled = true` and `sslVerifyServerCert = true`. The forwarder has a client certificate configured. The connection fails with 'SSL handshake failed: no client certificate presented'. What is the most likely cause?

The forwarder's `sslVerifyServerCert` should be set to false.

The indexer's `[splunktcp-ssl://9997]` stanza is missing `sslPassword`.

The forwarder's `sslCert` and `sslPassword` settings are not configured in outputs.conf.

The indexer's `sslCAFile` is not set.

What is the purpose of enabling SSL/TLS on S2S communication?

To authenticate users accessing Splunk Web

To encrypt data in transit between Splunk instances

To load balance data across multiple indexers

To compress data to reduce bandwidth usage

A Splunk admin is investigating why data from a forwarder is not appearing in the index. The forwarder's splunkd.log shows 'Connection to indexer:9997 established' and no errors. The indexer's splunkd.log shows the connection and no errors. The admin checks the index and finds no new events. What should the admin check next?

The forwarder's inputs.conf to see if any data sources are configured.

The forwarder's outputs.conf to verify the correct port is set.

The indexer's authentication.conf to verify the forwarder has permission.

The indexer's indexes.conf to verify the index exists.

A Splunk admin is configuring a forwarder to send data to an indexer cluster with indexer acknowledgment enabled. The admin wants to ensure that data is not lost if the forwarder crashes. What additional configuration is required?

Set `useACK = true` in outputs.conf.

Set `compressed = true` in outputs.conf.

Set `persistentQueueSize` in outputs.conf to enable a persistent queue.

Set `index = _internal` in outputs.conf.

A Splunk admin is designing a distributed deployment. A heavy forwarder collects data from a legacy system and must send it to an indexer cluster. The admin wants to ensure that if one indexer in the cluster is down, the forwarder sends to another. What is the correct way to configure this?

Use a deployment server to push data to the indexers.

Configure the heavy forwarder as a search head to distribute data.

List multiple indexers in the `server` setting of a single `[tcpout:primary]` stanza.

Create a separate `[tcpout]` stanza for each indexer and set `autoLB = true`.

SplunkCore Certified Consultant

Domain 4Objective 2

Articulate How One Splunk Instance Communicates with Another Splunk Instance (S2S) CORE-CERTIFIED-CONSULTANT Practice Questions (Page 1)

Part of the Data Collection domain, which accounts for 15% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

15%of the exam

Questions 1–5

1expert · hard
A Splunk admin is configuring SSL between a forwarder and an indexer. The indexer's `[splunktcp-ssl://9997]` stanza has `sslVerifyClientCert = true`. The forwarder's outputs.conf has `sslEnabled = true` and `sslVerifyServerCert = true`. The forwarder has a client certificate configured. The connection fails with 'SSL handshake failed: no client certificate presented'. What is the most likely cause?
Select an answer first
2foundation · easy
What is the purpose of enabling SSL/TLS on S2S communication?
Select an answer first
3application · medium
A Splunk admin is investigating why data from a forwarder is not appearing in the index. The forwarder's splunkd.log shows 'Connection to indexer:9997 established' and no errors. The indexer's splunkd.log shows the connection and no errors. The admin checks the index and finds no new events. What should the admin check next?
Select an answer first
4expert · hard
A Splunk admin is configuring a forwarder to send data to an indexer cluster with indexer acknowledgment enabled. The admin wants to ensure that data is not lost if the forwarder crashes. What additional configuration is required?
Select an answer first
5application · medium
A Splunk admin is designing a distributed deployment. A heavy forwarder collects data from a legacy system and must send it to an indexer cluster. The admin wants to ensure that if one indexer in the cluster is down, the forwarder sends to another. What is the correct way to configure this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.

Articulate How One Splunk Instance Communicates with Another Splunk Instance (S2S) CORE-CERTIFIED-CONSULTANT Practice Questions (Page 1)

Questions 1–5

What is the purpose of enabling SSL/TLS on S2S communication?

A Splunk admin is configuring a forwarder to send data to an indexer cluster with indexer acknowledgment enabled. The admin wants to ensure that data is not lost if the forwarder crashes. What additional configuration is required?

A Splunk admin is designing a distributed deployment. A heavy forwarder collects data from a legacy system and must send it to an indexer cluster. The admin wants to ensure that if one indexer in the cluster is down, the forwarder sends to another. What is the correct way to configure this?

Keep studying — Data Collection