Question 1

Which of the following is a correct statement about Universal Forwarders?

Options :

A : The Universal Forwarder must be able to contact the license master.

B : A Universal Forwarder must connect to Splunk Cloud via a Heavy Forwarder.

C : A Universal Forwarder can be an Intermediate Forwarder.

D : The default output bandwidth is 500KBps.

Answer: C

Question 2

If a new event's raw data contains a timestamp, what is the next check (or decision) that Splunk makes in the event timestamp processing logic?

Options :

A : Check if explicit time extraction rules exist in props.conf.

B : Check if the event contains a date.

C : Check if the file name contains a date.

D : Check if timestamps of nearby events from the same source are within a ten minute offset.

Answer: A

Question 3

If events are not forwarded from the Forwarder to the Splunk cloud, which option is appropriate for troubleshooting?

Options :

A : Execute a ping from the Forwarder and check that the splunk cloud URL can be reached.

B : Check the Fowarder output.log to ensure that forwarding is being carried out properly.

C : Run the oneshot command and check if the event is reachable.

D : Check the _audit index and see if there are any events where the Forwarder is host.

Answer: C

Question 4

What are the three types of data that indexes contain in Splunk Cloud?

Options :

A : Raw data, index data, and metadata

B : Raw data, event data, and metadata

C : Raw data, index data, and metrics data

D : Raw data, index data, and event data

Answer: A

Question 5

What is the main advantage of managed Splunk Cloud over self-service Splunk Cloud in terms of scalability and reliability?

Options :

A : Managed Splunk Cloud provides a single-instance environment that can scale up to 10TB/day and offers a 100% uptime SLA.

B : Managed Splunk Cloud provides a clustered environment that can scale up to 5TB/day and offers a 99.9% uptime SLA.

C : Managed Splunk Cloud provides a clustered environment that can scale up to 10TB/day and offers a 100% uptime SLA.

D : Managed Splunk Cloud provides a single-instance environment that can scale up to 5TB/day and offers a 99.9% uptime SLA

Answer: C

Higher Test Marks with Free Online SPLK-1005 Exam Practice