SPLK-1005 — Splunk Cloud Certified Admin
Splunk

Splunk Cloud Certified Admin (SPLK-1005) Practice Questions

★★★★★★ 4.8 113 verified reviews
119 questions
June 17, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Splunk Cloud Overview & Architecture (10%)
  • Index Management & Data Retention (15%)
  • Users, Roles, and Cloud Authentication (15%)
  • Cloud Configuration Controls & App Vetting (15%)
  • Forwarder Configuration & Token Management (15%)
  • Getting Data In - Data Inputs Detail (15%)
  • Event Parsing & Data Preview (15%)

Sample Questions (12 of 119 shown)

Q1 Splunk Cloud Overview
In Splunk Cloud, which of the following statements regarding REST API is true?
  1. REST API and Splunk HEC are on the same port.
  2. All REST API endpoints are open and available by default.
  3. REST API is not available in Splunk Cloud.
  4. A subset of REST API endpoints are enabled for customers to manage Splunk.
✓ Correct Answer: D
Splunk Cloud enables only a subset of REST API endpoints for customer use to ensure security and control over the environment.
Q2 Splunk Cloud Overview
Which task is not managed by the Splunk Cloud administrator?
  1. Creating users and roles.
  2. Managing knowledge objects.
  3. Upgrading the indexer's Splunk software.
  4. Forwarding events to Splunk Cloud.
✓ Correct Answer: C
Upgrading indexer software is managed by Splunk Cloud Support, not the customer administrator.
Q3 Splunk Cloud Overview
What is a key difference between Splunk Cloud and Splunk Enterprise?
  1. Splunk Cloud does not support forwarders.
  2. Splunk Cloud is a managed service where Splunk handles infrastructure maintenance.
  3. Splunk Cloud requires on-premises hardware.
  4. Splunk Cloud only supports Windows deployment.
✓ Correct Answer: B
Splunk Cloud is a fully managed service where Splunk handles infrastructure, upgrades, and maintenance.
Q4 Splunk Cloud Overview
In the Splunk Cloud topology, which component is fully managed by Splunk?
  1. Universal Forwarders
  2. Heavy Forwarders
  3. Indexers and Search Heads
  4. Deployment Server
✓ Correct Answer: C
Indexers and search heads in Splunk Cloud are managed by Splunk, while forwarders are managed by the customer.
Q5 Splunk Cloud Overview
What is the purpose of the Splunk Cloud Stack (SCS) in the Splunk Cloud architecture?
  1. To provide a web interface for managing forwarders.
  2. To represent the managed Splunk Cloud infrastructure including indexers and search heads.
  3. To manage customer billing and subscriptions.
  4. To provide a sandbox environment for testing.
✓ Correct Answer: B
The Splunk Cloud Stack (SCS) refers to the managed Splunk infrastructure components (indexers, search heads) in the cloud.
Q6 Splunk Cloud Overview
Which of the following is a primary difference between Self-Service Cloud and Managed Cloud in Splunk?
  1. Self-Service Cloud allows customers to manage their own indexers.
  2. Managed Cloud provides dedicated infrastructure with Splunk-managed administration.
  3. Self-Service Cloud does not support forwarders.
  4. Managed Cloud is only available for on-premises deployments.
✓ Correct Answer: B
Managed Cloud provides dedicated infrastructure where Splunk handles day-to-day administration and maintenance.
Q7 Splunk Cloud Overview
In Splunk Cloud, what is the role of the Cloud Monitoring Console (CMC)?
  1. To manage on-premises deployment servers.
  2. To provide visibility into the health and performance of the Splunk Cloud environment.
  3. To configure network inputs.
  4. To manage LDAP authentication.
✓ Correct Answer: B
The Cloud Monitoring Console provides administrators with visibility into the health, performance, and usage of their Splunk Cloud environment.
Q8 Splunk Cloud Overview
Which statement about Splunk Cloud data ingestion is true?
  1. Data can only be ingested via Universal Forwarders.
  2. Data can be ingested via forwarders, HEC, and Splunk Connect for Syslog.
  3. Data cannot be ingested from on-premises sources.
  4. All data must first go through a Heavy Forwarder.
✓ Correct Answer: B
Splunk Cloud supports multiple ingestion methods including Universal Forwarders, Heavy Forwarders, HEC, and Splunk Connect for Syslog.
Q9 Index Management
An index in Splunk is best described as which of the following?
  1. A query language for data search
  2. A real-time data monitoring tool
  3. A structured database like SQL
  4. A repository for parsed and searchable data
✓ Correct Answer: d
An index in Splunk stores parsed and searchable event data, making it available for search and analysis.
Q10 Index Management
When creating a new index, which is true about archiving expired events?
  1. Store expired events in private AWS-based storage.
  2. Expired events cannot be archived.
  3. Archive some expired events and discard others.
  4. Store expired events on-prem using your own storage systems.
✓ Correct Answer: D
Expired events in Splunk Cloud can be archived to customer-managed on-premises storage.
Q11 Index Management
When is data deleted from a Splunk Cloud index?
  1. When the deleteindex command is executed from CLI.
  2. When TA_Delete is downloaded from SplunkBase.
  3. When buckets roll to frozen without a defined archive.
  4. When data is deleted via the Splunk Cloud Admin GUI.
✓ Correct Answer: C
Data is deleted when buckets roll to frozen without a defined archive destination.
Q12 Index Management
What is the maximum retention period for data in Splunk Cloud indexes by default?
  1. 30 days
  2. 90 days
  3. The retention period depends on the license tier and index configuration.
  4. Data is retained indefinitely.
✓ Correct Answer: C
Retention periods in Splunk Cloud depend on the license tier, index settings, and customer requirements.

You've viewed 3 of 119 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

Aspiring Splunk Cloud administrators turn to the Splunk Cloud Certified Admin (SPLK-1005) certification to validate their expertise in cloud-specific data onboarding, forwarder configuration, and authentication management. Administered by Splunk through Pearson VUE, this 75-minute exam requires an active Splunk Core Certified Power User (SPLK-1002) certification as a formal prerequisite and focuses entirely on cloud platform administration rather than on-premise Enterprise management.

Candidates must complete either the Splunk Cloud Administration training path (lecture plus hands-on labs) or the Transitioning to Splunk Cloud course (for certified Enterprise Admins pivoting to cloud) on the STEP portal. A minimum of 3 to 6 months of daily hands-on experience provisioning users, onboarding data sources, and managing apps within a Splunk Cloud Platform stack is strongly recommended, alongside thorough study of the Splunk Cloud Admin Manual, Getting Data In Manual, and Vetting Splunk Apps Guide.

The SPLK-1005 blueprint covers 7 equally weighted domains (each at 15%, except Cloud Overview & Architecture at 10%). Key technical areas include cloud architecture vs. on-prem distinctions with data tier isolation and retention rules, SSO/SAML configuration with Okta and Azure AD including native authentication fallback behavior, the automated app vetting process for private custom apps, Universal Forwarder credential package deployment, HTTP Event Collector (HEC) endpoint and token management, cloud storage integrations like AWS S3 inputs, and event parsing via the Data Preview engine with props.conf timestamp and line-break rules.

For candidates preparing for the SPLK-1005 exam, our practice materials cover all 7 domains in the same proportions as the real test — from Splunk Cloud Overview with managed architecture vs. on-prem differences through Index Management with retention and data sizing restrictions, Users/Roles/Cloud Authentication with SSO (SAML/Okta/Azure AD) and native fallback mechanics, Cloud Configuration Controls with .conf file isolation limits and the app vetting system, Forwarder Configuration with the dynamic Universal Forwarder credentials package, Getting Data In with HEC endpoints, tokens, and AWS S3 integration, and Event Parsing with the Data Preview engine and props.conf timestamp configuration. Each online practice question includes a detailed answer explanation that walks through the cloud-specific administrative reasoning, while the downloadable PDF packages the same question bank for offline review during commutes or in environments without stable internet.

Start your free SPLK-1005 practice test today and gain confidence managing Splunk Cloud architecture, authentication, and data onboarding.

Official Exam Domains & Weighting

To successfully pass the SPLK-1005 exam, candidates must master the following core domains:
  • Domain 1: Splunk Cloud Overview & Architecture (10%)
Covers distinguishing managed cloud architecture vs. on-prem setups, understanding Splunk Service Details and tenant responsibilities, and navigating data tier isolation and basic data retention rules.
  • Domain 2: Index Management & Data Retention (15%)
Focuses on creating and configuring cloud index spaces via Splunk Web UI, managing index data storage with sizing restrictions and retirement properties, and navigating data self-storage export rules and settings.
  • Domain 3: Users, Roles, and Cloud Authentication (15%)
Tests managing native Splunk Cloud users with custom capability scopes, implementing single sign-on (SSO) using SAML providers (Okta, Azure AD), and tracking behavior and concurrency exceptions of native vs. external authorization types.
  • Domain 4: Cloud Configuration Controls & App Vetting (15%)
Addresses understanding cloud .conf file isolation restrictions (admin-configurable vs. Splunk Support only), installing apps via Splunkbase or the automated private app upload vetting system, and troubleshooting application blockage and compatibility errors.
  • Domain 5: Forwarder Configuration & Token Management (15%)
Covers configuring Universal Forwarders to securely send traffic into Splunk Cloud, downloading and maintaining the dynamic Splunk Cloud forwarder credentials package, and configuring index routing targets and outputs.
  • Domain 6: Getting Data In - Data Inputs Detail (15%)
Explains setting up HTTP Event Collector (HEC) endpoints with token generation and payload balancing, plus configuring cloud file monitor streams, scripted inputs, and cloud storage integrations (e.g., AWS S3 inputs).
  • Domain 7: Event Parsing & Data Preview (15%)
Addresses utilizing the web UI Data Preview engine to parse raw formatting logs before committing, and determining timestamp processing patterns (props.conf logic), line breaks, and event break segmentation rules.

What Our Customers Say 113 verified reviews

4.8 ★★★★★★ Based on 113 reviews
★★★★★★
Worth every cent for the SPLK-1005 certification prep. Detailed answers helped me understand concepts I was shaky on.
— Zachary M.
★★★★★★
Good bang for your buck on the SPLK-1005 practice exam. Unlimited attempts means you can really drill the material.
— Zoey L.
★★★★★★
Lifetime access was the selling point for me. Got sidetracked for a few months and came back — everything was still there for SPLK-1005.
— Layla S.
★★★★★
Couldn’t have passed the SPLK-1005 exam without this. The questions are challenging, the explanations are thorough, and the value is unbeatable.
— Hannah L.
★★★★★★
Best SPLK-1005 prep I’ve found online. The question pool is deep and the randomized practice mode keeps you on your toes.
— Mason T.
★★★★★★
The SPLK-1005 bank has a good mix of easy, medium, and hard questions. Kept me engaged and prevented me from getting complacent.
— Skylar M.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

File access limitations. In Enterprise Admin, you have direct CLI/root access to edit files like indexes.conf or inputs.conf. In Splunk Cloud Admin, you are barred from CLI access and must use the Splunk Web UI or the cloud app ingestion framework. Our practice questions include scenario-based exercises that test this cloud vs. on-prem distinction.

When configuring SAML or LDAP on Splunk Cloud, native Splunk authentication remains active as a fallback mechanic, ensuring administrators can still log in using local break-glass credentials if the corporate Identity Provider (IdP) goes down. Our practice materials include SSO fallback scenarios with Okta and Azure AD configurations.

Splunk Cloud enforces a strict auto-vetting process. Any custom app must pass through the automated cloud vetting engine to verify no security risks, illegal directory scripts, or malicious .conf parameters exist. Apps that fail cannot be pushed live until fixed. Our practice sets include app vetting workflow questions.

You download a pre-packaged Splunk Cloud Forwarder Credentials app from your cloud instance rather than manually writing SSL certificate paths. Installing this app on your Universal Forwarders automatically applies the secure outbound certificates, routing addresses, and ports needed to reach your cloud endpoint. Our practice questions cover credential package deployment scenarios.

Our mock exam covers all 7 domains with the same weight distribution as the real test — from cloud architecture vs. on-prem distinctions and data tier isolation through SSO/SAML authentication with Okta/Azure AD, automated app vetting workflows, Universal Forwarder credentials package deployment, HEC endpoint and token configuration, AWS S3 input setup, and Data Preview engine parsing with props.conf timestamp rules. Each question includes a detailed cloud-admin reasoning explanation.

Yes. The downloadable PDF contains the same question bank as the online version, including answer explanations covering cloud architecture and data tier isolation, SSO/SAML configuration with native fallback, .conf file restrictions and app vetting procedures, forwarder credentials package deployment, HEC endpoint management with token balancing, AWS S3 input configuration, and Data Preview/props.conf event break segmentation. It is designed for offline study without an internet connection.

Candidates frequently report Cloud Configuration Controls & App Vetting (15%) as the most challenging due to nuanced .conf file restriction rules and the automated vetting criteria. SSO/SAML authentication (15%) is also cited for its IdP fallback mechanics and multiple-provider configuration scenarios. Our practice questions include focused drills on these high-difficulty areas.