SPLUNK CLOUD ADMIN CERTIFICATION EXAM
True/False: Splunk Cloud is hosted and supported by Splunk; one does not need one's
own environment on-premises. - Answers-True
True/False: Splunk Enterprise typically offers a faster time to value than Splunk Cloud. -
Answers-False
True/False: Both of the following are available with Splunk Cloud:
* Dedicated Search Heads for investigation and analysis
* Option to scale using a combination of virtual and real infrastructure. - Answers-True
True/False: Splunk Cloud does not offer any "real infrastructure" options. - Answers-
False
True/False: Splunk Cloud can accept any text data as input. - Answers-True
Match the Splunk Cloud component with customer access to it:
COMPONENT:
Search Head
Indexer
Manager Node
ACCESS:
Hidden and controlled access
Visible and direct access
Hidden and no direct access - Answers-Search Head - Visible and direct access
Indexer - Hidden and no direct access
Manager Node - Hidden and controlled access
Which of the following are Splunk Cloud customer responsibilities?
Select all that apply.
Forward data to Splunk Cloud
Manage configurations such as sourcetype, index, and contextual details.
Configure Splunk Cloud network for high availability
Administer and coordinate changes to manage users
Determine data retention and archiving policies
,Authenticating users
Configuration and maintenance - Answers-All but:
Configure Splunk Cloud network for high availability
What app allows for SSL and TLS forwarding unique to the customer environment? -
Answers-Forwarder Credentials App
What are the two Splunk Cloud Platform Experience designations? - Answers-Classic
and Victoria
True/False: Hybrid search is not supported in the Victoria Experience. - Answers-True
For modular and scripted inputs in the classic experience, these must run on a separate
______ instance or on-premise _________. - Answers-IDM, heavy forwarder.
True/False: For the Victoria Experience, modular and scripted inputs run directly on the
search tier. - Answers-True
Which Splunk experience offers HEC configuration using Splunk Web and Admin Config
Service (ACS) API? - Answers-Victoria
True/False: Splunk Cloud does not support UDP. - Answers-True
True/False: Splunk Cloud customers have no CLI access. - Answers-True
Which Splunk deployment allows customers to decide what app runs in their
deployment, including unvetted apps? - Answers-On-Prem/Enterprise
(not Cloud)
True/False: Splunk Cloud contracts cannot include Professional or Education credits. -
Answers-False
True/False: Splunk Cloud can control access via authentication and IP address. -
Answers-True
What are the three authentication protocols offered by Splunk Cloud? - Answers-Splunk
native, SAML, LDAP
In Splunk Cloud, apps are installed via the ________ and deployed via the
___________. - Answers-Search head, management app
True/False: Because Splunk Cloud does not accept UDP connections, syslog data
cannot be imported. - Answers-False
,True/False: Splunk Cloud Search Heads can search on-premise and Cloud indexers by
default. - Answers-False
When Hybrid Search Topology is enabled, what are two very important limitations? -
Answers-* Cannot search multiple Cloud environments
* Cannot search from Cloud Search Head to on-prem Splunk or to another Splunk
Cloud
What provides the capability to execute a unified search across multiple Splunk
environments (including Splunk Cloud and On-premise?) - Answers-Federated Search
True/False: Scheduled search is supported with Hybrid Search. - Answers-False
True/False: Federated Search is available for Classic customer adoption. - Answers-
True
True/False: Federated Search allows for both ad-hoc and scheduled searching. -
Answers-True
True/False: Using Federated Search, we can only use generating SPL commands. -
Answers-True
The two Splunk Cloud licensing options are ______-based and _______-based. -
Answers-Ingestion
Infrastructure
True/False: Ingestion violations in Splunk Cloud are not enforced; they are monitored
and adjustments to volume or infrastructure resourcing is done on usage review of
consumption and to meet performance challenges and customer growth. - Answers-
True
True/False: Just like Splunk Enterprise, Splunk Cloud can accept any text data as input.
- Answers-True
Which two Splunk components are the only two components which can reside on-
premise? - Answers-Universal Forwarder
Intermediate/Heavy forwarder
True/False: Customers have direct and visible access to search heads. - Answers-True
True/False: Customers have direct and visible access to indexers. - Answers-False
(hidden and no direct access)
, True/False: Customers have direct and visible access to the Manager Node (COM.) -
Answers-False
(hidden and controlled access)
True/False: SVC (infrastructure-based licensing unit) stands for Splunk Virtual
Commander. - Answers-False
Splunk Virtual Core
Which of the following is not a benefit of Splunk Cloud?
Select one.
* Troubleshooting support and advice
* Automated infrastructure deployment
* Automated processing and implementation
* Automated high availability setup
* Regular maintenance and upgrades
* 24/7 NOC - Answers-Automated high availability setup
True/False: Cloud Search Head offers CLI access. - Answers-False
True/False: Splunk Cloud does not offer license pooling. - Answers-True
Which of the following is NOT performed via Splunk Cloud Search Heads?
Select one.
* Install and manage apps
* Define inputs and configure parsing
* Create and manage indexes
* Manage knowledge objects
* Integrate with LDAP/SAML
* Manage data retention - Answers-Define inputs and configure parsing - these are done
at the on-prem source
What provides the customer with monitoring and details of the topology, ingestion and
search data activity, and an orientation on the overall health and performance of the
deployment? - Answers-The CMC.
True/False: Splunk Cloud is hosted and supported by Splunk; one does not need one's
own environment on-premises. - Answers-True
True/False: Splunk Enterprise typically offers a faster time to value than Splunk Cloud. -
Answers-False
True/False: Both of the following are available with Splunk Cloud:
* Dedicated Search Heads for investigation and analysis
* Option to scale using a combination of virtual and real infrastructure. - Answers-True
True/False: Splunk Cloud does not offer any "real infrastructure" options. - Answers-
False
True/False: Splunk Cloud can accept any text data as input. - Answers-True
Match the Splunk Cloud component with customer access to it:
COMPONENT:
Search Head
Indexer
Manager Node
ACCESS:
Hidden and controlled access
Visible and direct access
Hidden and no direct access - Answers-Search Head - Visible and direct access
Indexer - Hidden and no direct access
Manager Node - Hidden and controlled access
Which of the following are Splunk Cloud customer responsibilities?
Select all that apply.
Forward data to Splunk Cloud
Manage configurations such as sourcetype, index, and contextual details.
Configure Splunk Cloud network for high availability
Administer and coordinate changes to manage users
Determine data retention and archiving policies
,Authenticating users
Configuration and maintenance - Answers-All but:
Configure Splunk Cloud network for high availability
What app allows for SSL and TLS forwarding unique to the customer environment? -
Answers-Forwarder Credentials App
What are the two Splunk Cloud Platform Experience designations? - Answers-Classic
and Victoria
True/False: Hybrid search is not supported in the Victoria Experience. - Answers-True
For modular and scripted inputs in the classic experience, these must run on a separate
______ instance or on-premise _________. - Answers-IDM, heavy forwarder.
True/False: For the Victoria Experience, modular and scripted inputs run directly on the
search tier. - Answers-True
Which Splunk experience offers HEC configuration using Splunk Web and Admin Config
Service (ACS) API? - Answers-Victoria
True/False: Splunk Cloud does not support UDP. - Answers-True
True/False: Splunk Cloud customers have no CLI access. - Answers-True
Which Splunk deployment allows customers to decide what app runs in their
deployment, including unvetted apps? - Answers-On-Prem/Enterprise
(not Cloud)
True/False: Splunk Cloud contracts cannot include Professional or Education credits. -
Answers-False
True/False: Splunk Cloud can control access via authentication and IP address. -
Answers-True
What are the three authentication protocols offered by Splunk Cloud? - Answers-Splunk
native, SAML, LDAP
In Splunk Cloud, apps are installed via the ________ and deployed via the
___________. - Answers-Search head, management app
True/False: Because Splunk Cloud does not accept UDP connections, syslog data
cannot be imported. - Answers-False
,True/False: Splunk Cloud Search Heads can search on-premise and Cloud indexers by
default. - Answers-False
When Hybrid Search Topology is enabled, what are two very important limitations? -
Answers-* Cannot search multiple Cloud environments
* Cannot search from Cloud Search Head to on-prem Splunk or to another Splunk
Cloud
What provides the capability to execute a unified search across multiple Splunk
environments (including Splunk Cloud and On-premise?) - Answers-Federated Search
True/False: Scheduled search is supported with Hybrid Search. - Answers-False
True/False: Federated Search is available for Classic customer adoption. - Answers-
True
True/False: Federated Search allows for both ad-hoc and scheduled searching. -
Answers-True
True/False: Using Federated Search, we can only use generating SPL commands. -
Answers-True
The two Splunk Cloud licensing options are ______-based and _______-based. -
Answers-Ingestion
Infrastructure
True/False: Ingestion violations in Splunk Cloud are not enforced; they are monitored
and adjustments to volume or infrastructure resourcing is done on usage review of
consumption and to meet performance challenges and customer growth. - Answers-
True
True/False: Just like Splunk Enterprise, Splunk Cloud can accept any text data as input.
- Answers-True
Which two Splunk components are the only two components which can reside on-
premise? - Answers-Universal Forwarder
Intermediate/Heavy forwarder
True/False: Customers have direct and visible access to search heads. - Answers-True
True/False: Customers have direct and visible access to indexers. - Answers-False
(hidden and no direct access)
, True/False: Customers have direct and visible access to the Manager Node (COM.) -
Answers-False
(hidden and controlled access)
True/False: SVC (infrastructure-based licensing unit) stands for Splunk Virtual
Commander. - Answers-False
Splunk Virtual Core
Which of the following is not a benefit of Splunk Cloud?
Select one.
* Troubleshooting support and advice
* Automated infrastructure deployment
* Automated processing and implementation
* Automated high availability setup
* Regular maintenance and upgrades
* 24/7 NOC - Answers-Automated high availability setup
True/False: Cloud Search Head offers CLI access. - Answers-False
True/False: Splunk Cloud does not offer license pooling. - Answers-True
Which of the following is NOT performed via Splunk Cloud Search Heads?
Select one.
* Install and manage apps
* Define inputs and configure parsing
* Create and manage indexes
* Manage knowledge objects
* Integrate with LDAP/SAML
* Manage data retention - Answers-Define inputs and configure parsing - these are done
at the on-prem source
What provides the customer with monitoring and details of the topology, ingestion and
search data activity, and an orientation on the overall health and performance of the
deployment? - Answers-The CMC.
