A security-conscious organization requires that all Splunk-to-Splunk traffic between forwarders and indexers be encrypted and that both parties verify each other's identity. The admin has already enabled SSL on the indexer's splunktcp stanza. What additional configuration is required on the forwarder to meet the mutual authentication requirement?

Set `sslPassword = ` in outputs.conf to encrypt the data channel.

Add `[splunktcp-ssl://9997]` to the forwarder's inputs.conf.

Set `compressed = true` in outputs.conf to secure the data in transit.

Set `sslVerifyServerCert = true` and provide a client certificate in outputs.conf.

Which log file on the indexer would you check first to see if it is accepting S2S connections?

splunkd.log with the TcpInputProcessor component

A Splunk admin is troubleshooting a forwarder that is sending data to an indexer. The forwarder's splunkd.log shows 'Connection to indexer:9997 established' and then 'Connection to indexer:9997 closed' immediately after. The indexer's splunkd.log shows 'Connection from forwarder accepted' and then 'Connection from forwarder closed'. No data is being indexed. What is the most likely cause?

The forwarder's `useACK` setting is causing the indexer to close the connection.

The indexer's `maxConcurrentSplunkd` is too low.

The indexer's `[splunktcp://9997]` stanza is missing `disabled = false`.

The forwarder has no data to send, so it closes the connection.

In a typical Splunk deployment, which two roles communicate over S2S?

Search head and deployment server

SplunkCore Certified Consultant

Domain 4Objective 2

Articulate How One Splunk Instance Communicates with Another Splunk Instance (S2S) CORE-CERTIFIED-CONSULTANT Practice Questions (Page 4)

Part of the Data Collection domain, which accounts for 15% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

15%of the exam

Questions 16–20

16application · medium
A security-conscious organization requires that all Splunk-to-Splunk traffic between forwarders and indexers be encrypted and that both parties verify each other's identity. The admin has already enabled SSL on the indexer's splunktcp stanza. What additional configuration is required on the forwarder to meet the mutual authentication requirement?
Select an answer first
17foundation · easy
Which log file on the indexer would you check first to see if it is accepting S2S connections?
Select an answer first
18foundation · easy
Which setting must be enabled on both the forwarder and the indexer to use indexer acknowledgment?
Select an answer first
19expert · hard
A Splunk admin is troubleshooting a forwarder that is sending data to an indexer. The forwarder's splunkd.log shows 'Connection to indexer:9997 established' and then 'Connection to indexer:9997 closed' immediately after. The indexer's splunkd.log shows 'Connection from forwarder accepted' and then 'Connection from forwarder closed'. No data is being indexed. What is the most likely cause?
Select an answer first
20foundation · easy
In a typical Splunk deployment, which two roles communicate over S2S?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.

Articulate How One Splunk Instance Communicates with Another Splunk Instance (S2S) CORE-CERTIFIED-CONSULTANT Practice Questions (Page 4)

Questions 16–20

Which log file on the indexer would you check first to see if it is accepting S2S connections?

Which setting must be enabled on both the forwarder and the indexer to use indexer acknowledgment?

In a typical Splunk deployment, which two roles communicate over S2S?

Keep studying — Data Collection