Splunk SPLK-1005 Actual Free Exam Questions & Community Discussion

Exam Code/Number: SPLK-1005
Exam Name/Title: Splunk Cloud Certified Admin
Certification Provider: Splunk
Corresponding Certification: Splunk Cloud Certified Admin

Exam Questions: 82
Updated On: May 29, 2026

Question #37

Which of the following is true when using Intermediate Forwarders?

A. All Intermediate Forwarders must be Universal Forwarders.

B. Intermediate Forwarders may be Universal Forwarders or Heavy Forwarders, but may not be mixed.

C. All Intermediate Forwarders must be Heavy Forwarders.

D. Intermediate Forwarders may be a mix of Universal and Heavy Forwarders.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #38

In which file can the SH0ULD_LINEMERCE setting be modified?

A. transforms.conf

B. inputs.conf

C. outputs.conf

D. props.conf

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #39

Configuration folders named default contain configuration files/settings specified in the Splunk product or default settings specified in apps. Which of the following is recommended to override these settings?

A. It does not matter whether setting overrides are placed in default or local folders. Both are equally acceptable since Splunk will merge all the files together into one runtime model after each restart.

B. Any settings to be overridden should be modified in-place wherever the setting was found originally.
For example, if overriding a setting originally found in system/default, it should be overridden there to ensure that the desired value is used by Splunk.

C. Try to store all configuration overrides in system/local folder to keep all configurations in one place. This ensures the modification has the highest precedence over all other configuration entries.

D. Overrides should be placed in a folder named local, ideally within a custom Splunk app. This ensures the overrides are preserved upon product or app upgrade and will also be easier to maintain/support.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #40

When adding a directory monitor and specifying a sourcetype explicitly, it applies to all files in the directory and subdirectories. If automatic sourcetyping is used, a user can selectively override it in which file on the forwarder?

A. transforms.conf

B. outputs.cont

C. inputs.conf

D. props.conf

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #41

Due to internal security policies, a Splunk Cloud administrator cannot send data directly to Splunk Cloud from certain data sources. Additional parsing and API-based data sources also need to be sent to Splunk Cloud. What forwarder type should the Splunk Cloud administrator use to satisfy these requirements within their environment?

A. Syslog-ng server with a universal forwarder

B. Heavy forwarder as an intermediate forwarder

C. Light forwarder as an intermediate forwarder

D. Universal forwarder as an intermediate forwarder

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #42

What is the recommended approach to collect data from network devices?

A. TCP/UDP Feed > Heavy Forwarder > Intermediate Forwarder > Splunk Cloud

B. TCP/UDP Feed > Intermediate Forwarder > Heavy Forwarder > Splunk Cloud

C. TCP/UDP Feed > Syslog Server with Universal Forwarder > Splunk Cloud

D. TCP/UDP Feed > Universal Forwarder > Intermediate Forwarder > Splunk Cloud

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #43

Which of the following is correct in regard to configuring a Universal Forwarder as an Intermediate Forwarder?

A. The configuration changes can be made using CU, directly in configuration files, or via a deployment app.

B. It is only possible to make this change directly in configuration files or via a deployment app.

C. This can only be turned on using the Settings > Forwarding and Receiving menu in Splunk Web/UI.

D. The configuration changes can be made using Splunk Web. CU, directly in configuration files, or via a deployment app.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #44

When is data deleted from a Splunk Cloud index?

A. When TA_Delete is downloaded and enabled from SplunkBase.

B. When data is deleted via the Splunk Cloud Admin GUI.

C. When the daleteindex command is executed from the CLI.

D. When buckets roll to frozen, without a defined archive.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #45

Which of the following statements regarding apps in Splunk Cloud is true?

A. Self-service install of premium apps is possible.

B. Only Cloud certified and vetted apps are supported.

C. Self-service install is available for all apps on Splunkbase.

D. Any app that can be deployed in an on-prem Splunk Enterprise environment is also supported on Splunk Cloud.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Download Free Splunk SPLK-1005 Demo

Simply submit your e-mail address below to get started with our free demo of your Splunk SPLK-1005 exam.