Splunk Cloud Certified Admin (SPLK-1005) practice questions

Exam overview SPLK-1005

Domain coverage 7 domains

• Splunk Cloud Overview & Architecture (10%)
• Index Management & Data Retention (15%)
• Users, Roles, and Cloud Authentication (15%)
• Cloud Configuration Controls & App Vetting (15%)
• Forwarder Configuration & Token Management (15%)
• Getting Data In - Data Inputs Detail (15%)
• Event Parsing & Data Preview (15%)

Sample questions 12 of 119 shown

1. Q1 Splunk Cloud Overview

   In Splunk Cloud, which of the following statements regarding REST API is true?

   1. REST API and Splunk HEC are on the same port.
   2. All REST API endpoints are open and available by default.
   3. REST API is not available in Splunk Cloud.
   4. A subset of REST API endpoints are enabled for customers to manage Splunk.

   Splunk Cloud enables only a subset of REST API endpoints for customer use to ensure security and control over the environment.
2. Q2 Splunk Cloud Overview

   Which task is not managed by the Splunk Cloud administrator?

   1. Creating users and roles.
   2. Managing knowledge objects.
   3. Upgrading the indexer's Splunk software.
   4. Forwarding events to Splunk Cloud.

   Upgrading indexer software is managed by Splunk Cloud Support, not the customer administrator.
3. Q3 Splunk Cloud Overview

   What is a key difference between Splunk Cloud and Splunk Enterprise?

   1. Splunk Cloud does not support forwarders.
   2. Splunk Cloud is a managed service where Splunk handles infrastructure maintenance.
   3. Splunk Cloud requires on-premises hardware.
   4. Splunk Cloud only supports Windows deployment.

   Splunk Cloud is a fully managed service where Splunk handles infrastructure, upgrades, and maintenance.
4. Q4 Splunk Cloud Overview

   In the Splunk Cloud topology, which component is fully managed by Splunk?

   1. Universal Forwarders
   2. Heavy Forwarders
   3. Indexers and Search Heads
   4. Deployment Server

   Indexers and search heads in Splunk Cloud are managed by Splunk, while forwarders are managed by the customer.
5. Q5 Splunk Cloud Overview

   What is the purpose of the Splunk Cloud Stack (SCS) in the Splunk Cloud architecture?

   1. To provide a web interface for managing forwarders.
   2. To represent the managed Splunk Cloud infrastructure including indexers and search heads.
   3. To manage customer billing and subscriptions.
   4. To provide a sandbox environment for testing.

   The Splunk Cloud Stack (SCS) refers to the managed Splunk infrastructure components (indexers, search heads) in the cloud.
6. Q6 Splunk Cloud Overview

   Which of the following is a primary difference between Self-Service Cloud and Managed Cloud in Splunk?

   1. Self-Service Cloud allows customers to manage their own indexers.
   2. Managed Cloud provides dedicated infrastructure with Splunk-managed administration.
   3. Self-Service Cloud does not support forwarders.
   4. Managed Cloud is only available for on-premises deployments.

   Managed Cloud provides dedicated infrastructure where Splunk handles day-to-day administration and maintenance.
7. Q7 Splunk Cloud Overview

   In Splunk Cloud, what is the role of the Cloud Monitoring Console (CMC)?

   1. To manage on-premises deployment servers.
   2. To provide visibility into the health and performance of the Splunk Cloud environment.
   3. To configure network inputs.
   4. To manage LDAP authentication.

   The Cloud Monitoring Console provides administrators with visibility into the health, performance, and usage of their Splunk Cloud environment.
8. Q8 Splunk Cloud Overview

   Which statement about Splunk Cloud data ingestion is true?

   1. Data can only be ingested via Universal Forwarders.
   2. Data can be ingested via forwarders, HEC, and Splunk Connect for Syslog.
   3. Data cannot be ingested from on-premises sources.
   4. All data must first go through a Heavy Forwarder.

   Splunk Cloud supports multiple ingestion methods including Universal Forwarders, Heavy Forwarders, HEC, and Splunk Connect for Syslog.
9. Q9 Index Management

   An index in Splunk is best described as which of the following?

   1. A query language for data search
   2. A real-time data monitoring tool
   3. A structured database like SQL
   4. A repository for parsed and searchable data

   An index in Splunk stores parsed and searchable event data, making it available for search and analysis.
10. Q10 Index Management

    When creating a new index, which is true about archiving expired events?

    1. Store expired events in private AWS-based storage.
    2. Expired events cannot be archived.
    3. Archive some expired events and discard others.
    4. Store expired events on-prem using your own storage systems.

    Expired events in Splunk Cloud can be archived to customer-managed on-premises storage.
11. Q11 Index Management

    When is data deleted from a Splunk Cloud index?

    1. When the deleteindex command is executed from CLI.
    2. When TA_Delete is downloaded from SplunkBase.
    3. When buckets roll to frozen without a defined archive.
    4. When data is deleted via the Splunk Cloud Admin GUI.

    Data is deleted when buckets roll to frozen without a defined archive destination.
12. Q12 Index Management

    What is the maximum retention period for data in Splunk Cloud indexes by default?

    1. 30 days
    2. 90 days
    3. The retention period depends on the license tier and index configuration.
    4. Data is retained indefinitely.

    Retention periods in Splunk Cloud depend on the license tier, index settings, and customer requirements.

Answer all 119 questions with instant feedback →

Reader reviews 151 ratings

• I had almost given up on SPLK-1005 after failing twice. These questions pinpointed exactly what I was missing. Third time’s the charm!

  ★★★★★ Noah S.

• This SPLK-1005 practice test is no joke — questions are challenging but fair. If you can pass these, you’ll pass the real exam.

  ★★★★★★ William C.

• First time using online prep for a certification. The SPLK-1005 questions were clear, accurate, and well worth the price.

  ★★★★★★ Abigail M.

• Good bang for your buck on the SPLK-1005 practice exam. Unlimited attempts means you can really drill the material.

  ★★★★★★ Zoey L.

• Passed the SPLK-1005 exam today! The scenario-based questions here were extremely similar to what I saw on the test.

  ★★★★★ Riley B.

• I work full time and study at night. The SPLK-1005 question bank allowed me to learn efficiently without wasting precious time.

  ★★★★★★ Harper S.

Frequently asked questions

More Splunk exams