SplunkCore Certified Consultant
Domain 4Objective 2
Articulate How One Splunk Instance Communicates with Another Splunk Instance (S2S) CORE-CERTIFIED-CONSULTANT Practice Questions (Page 6)
Part of the Data Collection domain, which accounts for 15% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–3 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)
29questions here
6free pages
6concepts
15%of the exam
Questions 26–29
- 26
A Splunk admin is troubleshooting a forwarder that intermittently stops sending data. The forwarder's splunkd.log shows repeated 'Connection reset by peer' messages, followed by reconnection attempts. The indexer's splunkd.log shows no errors. The network team confirms no packet loss. What is the most likely cause?
Select an answer first - 27
Which configuration file on a forwarder is used to define an S2S output to an indexer?
Select an answer first - 28
A Splunk admin has a universal forwarder sending data to an indexer. The data was flowing fine, but after a recent network change, the forwarder's splunkd.log shows 'TcpOutputProc: Connection to 10.1.2.3:9997 timed out'. The indexer is confirmed up and its splunktcp listener is active. What is the most likely cause?
Select an answer first - 29
A Splunk admin is configuring mutual TLS between a forwarder and an indexer. The admin generates a self-signed certificate for the indexer and a separate self-signed certificate for the forwarder. The forwarder's outputs.conf has `sslVerifyServerCert = true` and `sslCAFile = /opt/splunk/etc/auth/indexer-ca.pem`. The indexer's inputs.conf has `sslVerifyClientCert = true` and `sslCAFile = /opt/splunk/etc/auth/forwarder-ca.pem`. The connection fails with a certificate verification error on both sides. What is the most likely fix?
Select an answer first
Finished these 4 questions?
Review the revealed explanations, or continue through the curriculum.
No more pagesBack to CORE-CERTIFIED-CONSULTANT
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.