Splunk Cloud Certified Admin Free Sample Questions

A financial services company is using Splunk Cloud Platform and has a requirement to segregate data from their trading, compliance, and retail banking applications into distinct indexes. The Splunk Cloud admin has created the indexes: trading_prod, compliance_prod, and retail_prod. To control access, three roles have been created: trading_user, compliance_user, and retail_user. Which configuration ensures that users in the trading_user role can only search the trading_prod index and no other indexes?

A Splunk Cloud administrator is configuring a monitor input on a Universal Forwarder to collect logs from /var/log/app/. This directory contains access.log, error.log, and debug.log. The administrator wants to assign different sourcetypes (app_access, app_error, app_debug) based on the filename. What is the most efficient method to achieve this on the data input side?

A Splunk Cloud administrator is troubleshooting an issue where events from a critical application are not being indexed. The data is sent from a Universal Forwarder to Splunk Cloud. The administrator runs the following command on the forwarder: splunk list forward-server. The output shows the Splunk Cloud indexer endpoint is active. What is the next logical step to diagnose the problem on the Universal Forwarder?

A Splunk Cloud admin needs to onboard a new data source that produces multi-line Java stack traces. Each event begins with a timestamp, but subsequent lines of the stack trace do not. How should the administrator configure line breaking to ensure each full stack trace is treated as a single event?

Example event:

2023-10-27 10:30:15,123 ERROR [main] com.example.App - An exception occurred
java.lang.RuntimeException: Operation failed
at com.example.Service.performAction(Service.java:42)
at com.example.App.main(App.java:10)

True or False: In a Splunk Cloud Platform environment, a Cloud administrator can directly edit the authorize.conf file in the backend to create and modify user roles.

An e-commerce company uses the Splunk HTTP Event Collector (HEC) to ingest transaction data from a microservice. To ensure data is routed to the correct index and assigned the correct sourcetype, the developers have been instructed to include specific HEC headers. However, the Splunk Cloud admin notices all data is landing in the default index for the HEC token. Which TWO of the following could be the cause of this issue? (Select TWO)

A Splunk Cloud admin needs to mask Personally Identifiable Information (PII) from incoming web server logs. Specifically, the credit card numbers in the format CCN=1234-5678-9012-3456 must be replaced with CCN=XXXX-XXXX-XXXX-XXXX at index time. Which configuration combination in props.conf and transforms.conf on the search head (or relevant parsing tier) will accomplish this?

A Splunk Cloud administrator is using a Deployment Server to manage a fleet of Universal Forwarders. A new server class, [serverClass:linux_web_servers], has been created to deploy a web log collection app. However, after creating the server class, none of the target Linux servers are downloading the new app. The whitelist.0 is correctly configured to match the hostnames. What is a common reason for this failure?

When creating a new index in Splunk Cloud Platform via the UI, what is the purpose of the 'Max Size of Entire Index' setting?

A Splunk Cloud admin is setting up a scripted input on a Linux Universal Forwarder. The script, /opt/splunkforwarder/bin/scripts/get_metrics.sh, runs correctly when executed manually from the command line. The inputs.conf stanza is as follows:

[script:///opt/splunkforwarder/bin/scripts/get_metrics.sh]
interval = 300
sourcetype = custom_metrics
index = metrics
disabled = 0

After configuration, no data appears in the metrics index. What is the most likely cause for this issue?