Splunk Enterprise Security Certified Analyst — Question 30

What is the Splunk PS recommendation when using the deployment server and building deployment apps?

Answer options

• A. Carefully design smaller apps with specific configuration that can be reused.
• B. Only deploy Splunk PS base configurations via the deployment server.
• C. Use $SPLUNK_HOME/etc/system/local configurations on forwarders and only deploy TAs via the deployment server.
• D. Carefully design bigger apps containing multiple configs.

Correct answer: A

Explanation

The correct answer is A because Splunk PS recommends that smaller, focused apps are more manageable and can be reused efficiently. Options B and C are incorrect as they limit the deployment scope unnecessarily, and option D contradicts the recommendation for smaller, reusable configurations.