Splunk Core Certified Consultant — Question 37

Which of the following is a correct statement about Universal Forwarders?

Answer options

• A. The Universal Forwarder must be able to contact the license master.
• B. Universal Forwarder must connect to Splunk Cloud via a Heavy Forwarder.
• C. Universal Forwarder can be an Intermediate Forwarder.
• D. The default output bandwidth is 500KBps.

Correct answer: C

Explanation

The correct answer is C, as Universal Forwarders can indeed serve as Intermediate Forwarders in a data collection architecture. Option A is incorrect because a Universal Forwarder does not need to contact a license master. Option B is wrong since Universal Forwarders can connect directly to Splunk Cloud without needing a Heavy Forwarder. Option D is incorrect because the default output bandwidth for Universal Forwarders is not specifically set at 500KBps.