QUESTION: 1
Which setting in indexes.conf allows data retention to be controlled by time?

A. maxDaysToKeep
B. moveToFrozenAfter
C. maxDataRetentionTime
D. frozenTimePeriodInSecs

Answer(s): D
Reference:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/SmartStoredataretention

QUESTION: 2
The universal forwarder has which capabilities when sending data? (Select all that apply.)

A. Sending alerts
B. Compressing data
C. Obfuscating/hiding data
D. Indexer acknowledgement

Answer(s): D
Reference:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Forwarding/Typesofforwarders

QUESTION: 3
In case of a conflict between a whitelist and a blacklist input setting, which one is used?

A. Blacklist
B. Whitelist
C. They cancel each other out.
D. Whichever is entered into the configuration first.

Answer(s): A
Reference:
https://www.google.com/url?
sa=t&rct=j&q=&esrc=s&source=web&cd=8&ved=2ahUKEwj0r6Lso6bkAhUqxYUKHbWlDz4QFj
AHegQIAxAC&url=http%3A%2F%2Fsplunk.training% 2Fshowpdf.asp%3Fdata%
3D789BB6B10C1B4376B548D711B4377F3F4B511B437805A8EC11B437742EA8F11B43779B
6FA211B4376EA657C11B4376FC19B311B4377E2407
E11B43730AF97411B4377F3F4B511B437742EA8F11B43779B6FA211B43771F822111B4377
31365811B43730AF97411B437789BB6B11B4376B548
D711B4377F3F4B511B437805A8EC11B437742EA8F11B43779B6FA211B4376EA657C11B43
76FC19B311B4377E2407E11B43732E61E211B4377F