A Splunk admin is setting up a new forwarder to send data to an indexer. The security team requires that all S2S traffic be encrypted. The admin enables SSL on the indexer's `[splunktcp-ssl://9997]` stanza. What must the admin configure on the forwarder to use this SSL listener?

Set `compressed = true` in the `[tcpout]` stanza.

Set `sslEnabled = true` in the `[tcpout:primary]` stanza of outputs.conf.

Change the `server` setting to use port 8089 instead of 9997.

Add `[splunktcp-ssl://9997]` to the forwarder's inputs.conf.

In outputs.conf, which setting specifies the receiving Splunk instance's address and port for S2S?

host = indexer.example.com:9997

index = indexer.example.com:9997

server = indexer.example.com:9997

target = indexer.example.com:9997

What is mutual authentication in the context of S2S?

The indexer authenticates to the forwarder using a shared secret

Both instances use the same SSL certificate for encryption

Both the forwarder and the indexer verify each other's certificates

The forwarder authenticates to the indexer using a username and password

SplunkCore Certified Consultant

Domain 4Objective 2

Articulate How One Splunk Instance Communicates with Another Splunk Instance (S2S) CORE-CERTIFIED-CONSULTANT Practice Questions (Page 5)

Part of the Data Collection domain, which accounts for 15% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

15%of the exam

Questions 21–25

21foundation · easy
What is the default TCP port used by Splunk for S2S data forwarding?
Select an answer first
22foundation · easy
Which protocol does Splunk use for S2S data forwarding?
Select an answer first
23application · medium
A Splunk admin is setting up a new forwarder to send data to an indexer. The security team requires that all S2S traffic be encrypted. The admin enables SSL on the indexer's `[splunktcp-ssl://9997]` stanza. What must the admin configure on the forwarder to use this SSL listener?
Select an answer first
24foundation · easy
In outputs.conf, which setting specifies the receiving Splunk instance's address and port for S2S?
Select an answer first
25foundation · easy
What is mutual authentication in the context of S2S?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.

Articulate How One Splunk Instance Communicates with Another Splunk Instance (S2S) CORE-CERTIFIED-CONSULTANT Practice Questions (Page 5)

Questions 21–25

What is the default TCP port used by Splunk for S2S data forwarding?

Which protocol does Splunk use for S2S data forwarding?

A Splunk admin is setting up a new forwarder to send data to an indexer. The security team requires that all S2S traffic be encrypted. The admin enables SSL on the indexer's `[splunktcp-ssl://9997]` stanza. What must the admin configure on the forwarder to use this SSL listener?

In outputs.conf, which setting specifies the receiving Splunk instance's address and port for S2S?

What is mutual authentication in the context of S2S?

Keep studying — Data Collection