Splunk Core Certified Consultant — Question 2

Which of the following is correct in regard to configuring a Universal Forwarder as an Intermediate Forwarder?

Answer options

• A. This can only be turned on using the Settings > Forwarding and Receiving menu in Splunk Web/UI.
• B. The configuration changes can be made using Splunk Web, CLI, directly in configuration files, or via a deployment app.
• C. The configuration changes can be made using CLI, directly in configuration files, or via a deployment app.
• D. It is only possible to make this change directly in configuration files or via a deployment app.

Correct answer: C

Explanation

Option C is correct because it accurately states that configuration changes can be made via CLI, directly in configuration files, or through a deployment app. Option A is incorrect as it suggests that changes can only be made through the Splunk Web/UI, which is not true. Option B includes Splunk Web as a method, which is not applicable when configuring an Intermediate Forwarder. Option D is also incorrect because it excludes the CLI as a valid method for making changes.