Free Splunk SPLK-1005 Practice Test & Real Exam Questions

Exam Code/Number: SPLK-1005
Exam Name/Title: Splunk Cloud Certified Admin
Certification Provider: Splunk
Corresponding Certification: Splunk Cloud Certified Admin

Exam Questions: 102
Updated On: Jul 15, 2026

Question #1

Which of the following is correct in regard to configuring a Universal Forwarder as an Intermediate Forwarder?

A. The configuration changes can be made using Splunk Web. CU, directly in configuration files, or via a deployment app.

B. It is only possible to make this change directly in configuration files or via a deployment app.

C. This can only be turned on using the Settings > Forwarding and Receiving menu in Splunk Web/UI.

D. The configuration changes can be made using CU, directly in configuration files, or via a deployment app.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #2

When is data deleted from a Splunk Cloud index?

A. When TA_Delete is downloaded and enabled from SplunkBase.

B. When data is deleted via the Splunk Cloud Admin GUI.

C. When the daleteindex command is executed from the CLI.

D. When buckets roll to frozen, without a defined archive.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #3

A log file is being ingested into Splunk, and a few events have no date stamp. How would Splunk first try to determine the missing date of the events?

A. Splunk will use the current system time of the Indexer for the date.

B. Splunk will take the date from the file modification time.

C. Splunk will take the date of a previous event within the log file.

D. Splunk will use the date of when the file monitor was created.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #4

Which monitor statement will retrieve only files that start with "access" in the directory
/opt/log/www2/?

A. [monitor:///opt/log/.../]

B. [monitor:///opt/lug/.../access]

C. [monitor:///opt/log/www2/access*]

D. [monitor:///opt/log/www2/]

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #5

Which statement is true about monitor inputs?

A. Monitor inputs are configured in the monitor, conf file.

B. The ignoreOlderThan option allows files to be ignored based on the file modification time.

C. The crSalt setting is required.

D. Monitor inputs can ignore a file's existing content, indexing new data as it arrives, by configuring the tailProcessor option.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #6

The following Apache access log is being ingested into Splunk via a monitor input:

How does Splunk determine the time zone for this event?

A. The value of the TZ attribute in props, conf for the my.webserver.example host.

B. The value of the TZ attribute in props. cont for the a :ces3_ccwbined sourcetype.

C. The time zone indicator in the raw event data.

D. The time zone of the Heavy/Intermediate Forwarder with the monitor input.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #7

Which event ingestion method commonly transmits network and security logs using standardized logging protocols remotely?

A. Syslog forwarding securely transmits network device and security event logs toward Splunk infrastructures.

B. License Manager parses syslog events and performs field extractions during distributed searching operations automatically.

C. Search Head clustering synchronizes network security policies across enterprise authentication infrastructures continuously globally.

D. Deployment Server routing permanently archives firewall events before distributed indexing begins automatically worldwide.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #8

Which Splunk file primarily defines monitored data sources for onboarding enterprise log information continuously?

A. inputs.conf specifies monitored files, network ports, and ingestion source configurations centrally.

B. outputs.conf controls forwarding destinations and communication protocols toward remote indexers reliably.

C. web.conf customizes browser session handling and graphical interface display settings extensively.

D. indexes.conf manages storage paths and retention durations for indexed event repositories globally.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Question #9

Which of the following is true when integrating LDAP authentication?

A. New user data is cached the first time a user logs in.

B. Splunk stores LDAP end user names and passwords on search heads.

C. Splunk Cloud only supports Active Directory LDAP servers.

D. The mapping of LDAP groups to Splunk roles happens automatically.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for Pass4Leader members. You can sign-up / login (it's free).

Download Free Splunk SPLK-1005 Demo

Simply submit your e-mail address below to get started with our free demo of your Splunk SPLK-1005 exam.