Splunk Core Certified Consultant — Question 26

Which of the following stanzas would enable a TCP input on port 1025, allowing traffic from all IP addresses except 10.5.5.1?

Answer options

• A. [tcp://10.5.5.1:1025]
• B. [tcp://1025] acceptFrom = !10.5.5.1
• C. [tcp://1025]
• D. [tcp://1025] acceptFrom = 10.5.5.1

Correct answer: B

Explanation

Option B is correct because it explicitly allows TCP traffic on port 1025 while excluding traffic from the IP address 10.5.5.1. Options A and D include the specific IP address which would not enable the desired configuration, and option C does not include any restrictions on incoming traffic, allowing all IPs including 10.5.5.1.