Splunk Cloud Admin Certification Exam
2025
True/False: Splunk Cloud is hosted and supported by Splunk; one does not need one's own environment
on-premises. - ✅✅✅CORRECT -True
True/False: Splunk Enterprise typically offers a faster time to value than Splunk Cloud. -
✅✅✅CORRECT -False
True/False: Both of the following are available with Splunk Cloud:
* Dedicated Search Heads for investigation and analysis
* Option to scale using a combination of virtual and real infrastructure. - ✅✅✅CORRECT -True
True/False: Splunk Cloud does not offer any "real infrastructure" options. - ✅✅✅CORRECT -False
True/False: Splunk Cloud can accept any text data as input. - ✅✅✅CORRECT -True
Match the Splunk Cloud component with customer access to it:
COMPONENT:
Search Head
Indexer
Manager Node
ACCESS:
Hidden and controlled access
Visible and direct access
Hidden and no direct access - ✅✅✅CORRECT -Search Head - Visible and direct access
,Indexer - Hidden and no direct access
Manager Node - Hidden and controlled access
Which of the following are Splunk Cloud customer responsibilities?
Select all that apply.
Forward data to Splunk Cloud
Manage configurations such as sourcetype, index, and contextual details.
Configure Splunk Cloud network for high availability
Administer and coordinate changes to manage users
Determine data retention and archiving policies
Authenticating users
Configuration and maintenance - ✅✅✅CORRECT -All but:
Configure Splunk Cloud network for high availability
The two Splunk Cloud licensing options are ______-based and _______-based. - ✅✅✅CORRECT -
Ingestion
Infrastructure
,True/False: Ingestion violations in Splunk Cloud are not enforced; they are monitored and adjustments to
volume or infrastructure resourcing is done on usage review of consumption and to meet performance
challenges and customer growth. - ✅✅✅CORRECT -True
True/False: Just like Splunk Enterprise, Splunk Cloud can accept any text data as input. -
✅✅✅CORRECT -True
Which two Splunk components are the only two components which can reside on-premise? -
✅✅✅CORRECT -Universal Forwarder
Intermediate/Heavy forwarder
True/False: Customers have direct and visible access to search heads. - ✅✅✅CORRECT -True
True/False: Customers have direct and visible access to indexers. - ✅✅✅CORRECT -False
(hidden and no direct access)
True/False: Customers have direct and visible access to the Manager Node (COM.) - ✅✅✅CORRECT -
False
(hidden and controlled access)
True/False: SVC (infrastructure-based licensing unit) stands for Splunk Virtual Commander. -
✅✅✅CORRECT -False
Splunk Virtual Core
Which of the following is not a benefit of Splunk Cloud?
Select one.
* Troubleshooting support and advice
* Automated infrastructure deployment
, * Automated processing and implementation
* Automated high availability setup
* Regular maintenance and upgrades
* 24/7 NOC - ✅✅✅CORRECT -Automated high availability setup
True/False: Cloud Search Head offers CLI access. - ✅✅✅CORRECT -False
True/False: Splunk Cloud does not offer license pooling. - ✅✅✅CORRECT -True
What app allows for SSL and TLS forwarding unique to the customer environment? - ✅✅✅CORRECT
-Forwarder Credentials App
What are the two Splunk Cloud Platform Experience designations? - ✅✅✅CORRECT -Classic and
Victoria
True/False: Hybrid search is not supported in the Victoria Experience. - ✅✅✅CORRECT -True
For modular and scripted inputs in the classic experience, these must run on a separate ______ instance
or on-premise _________. - ✅✅✅CORRECT -IDM, heavy forwarder.
True/False: For the Victoria Experience, modular and scripted inputs run directly on the search tier. -
✅✅✅CORRECT -True
Which Splunk experience offers HEC configuration using Splunk Web and Admin Config Service (ACS)
API? - ✅✅✅CORRECT -Victoria
True/False: Splunk Cloud does not support UDP. - ✅✅✅CORRECT -True
2025
True/False: Splunk Cloud is hosted and supported by Splunk; one does not need one's own environment
on-premises. - ✅✅✅CORRECT -True
True/False: Splunk Enterprise typically offers a faster time to value than Splunk Cloud. -
✅✅✅CORRECT -False
True/False: Both of the following are available with Splunk Cloud:
* Dedicated Search Heads for investigation and analysis
* Option to scale using a combination of virtual and real infrastructure. - ✅✅✅CORRECT -True
True/False: Splunk Cloud does not offer any "real infrastructure" options. - ✅✅✅CORRECT -False
True/False: Splunk Cloud can accept any text data as input. - ✅✅✅CORRECT -True
Match the Splunk Cloud component with customer access to it:
COMPONENT:
Search Head
Indexer
Manager Node
ACCESS:
Hidden and controlled access
Visible and direct access
Hidden and no direct access - ✅✅✅CORRECT -Search Head - Visible and direct access
,Indexer - Hidden and no direct access
Manager Node - Hidden and controlled access
Which of the following are Splunk Cloud customer responsibilities?
Select all that apply.
Forward data to Splunk Cloud
Manage configurations such as sourcetype, index, and contextual details.
Configure Splunk Cloud network for high availability
Administer and coordinate changes to manage users
Determine data retention and archiving policies
Authenticating users
Configuration and maintenance - ✅✅✅CORRECT -All but:
Configure Splunk Cloud network for high availability
The two Splunk Cloud licensing options are ______-based and _______-based. - ✅✅✅CORRECT -
Ingestion
Infrastructure
,True/False: Ingestion violations in Splunk Cloud are not enforced; they are monitored and adjustments to
volume or infrastructure resourcing is done on usage review of consumption and to meet performance
challenges and customer growth. - ✅✅✅CORRECT -True
True/False: Just like Splunk Enterprise, Splunk Cloud can accept any text data as input. -
✅✅✅CORRECT -True
Which two Splunk components are the only two components which can reside on-premise? -
✅✅✅CORRECT -Universal Forwarder
Intermediate/Heavy forwarder
True/False: Customers have direct and visible access to search heads. - ✅✅✅CORRECT -True
True/False: Customers have direct and visible access to indexers. - ✅✅✅CORRECT -False
(hidden and no direct access)
True/False: Customers have direct and visible access to the Manager Node (COM.) - ✅✅✅CORRECT -
False
(hidden and controlled access)
True/False: SVC (infrastructure-based licensing unit) stands for Splunk Virtual Commander. -
✅✅✅CORRECT -False
Splunk Virtual Core
Which of the following is not a benefit of Splunk Cloud?
Select one.
* Troubleshooting support and advice
* Automated infrastructure deployment
, * Automated processing and implementation
* Automated high availability setup
* Regular maintenance and upgrades
* 24/7 NOC - ✅✅✅CORRECT -Automated high availability setup
True/False: Cloud Search Head offers CLI access. - ✅✅✅CORRECT -False
True/False: Splunk Cloud does not offer license pooling. - ✅✅✅CORRECT -True
What app allows for SSL and TLS forwarding unique to the customer environment? - ✅✅✅CORRECT
-Forwarder Credentials App
What are the two Splunk Cloud Platform Experience designations? - ✅✅✅CORRECT -Classic and
Victoria
True/False: Hybrid search is not supported in the Victoria Experience. - ✅✅✅CORRECT -True
For modular and scripted inputs in the classic experience, these must run on a separate ______ instance
or on-premise _________. - ✅✅✅CORRECT -IDM, heavy forwarder.
True/False: For the Victoria Experience, modular and scripted inputs run directly on the search tier. -
✅✅✅CORRECT -True
Which Splunk experience offers HEC configuration using Splunk Web and Admin Config Service (ACS)
API? - ✅✅✅CORRECT -Victoria
True/False: Splunk Cloud does not support UDP. - ✅✅✅CORRECT -True
