Splunk SPLK-1005 Exam - Topic 10 Question 21 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 21
Topic #: 10

[All SPLK-1005 Questions]

When using Splunk Universal Forwarders, which of the following is true?

ANo more than six Universal Forwarders may connect directly to Splunk Cloud.

BAny number of Universal Forwarders may connect directly to Splunk Cloud.

CUniversal Forwarders must send data to an Intermediate Forwarder.

DThere must be one Intermediate Forwarder for every three Universal Forwarders.

Show Suggested Answer

Suggested Answer: B

Universal Forwarders can connect directly to Splunk Cloud, and there is no limit on the number of Universal Forwarders that may connect directly to it. This capability allows organizations to scale their data ingestion easily by deploying as many Universal Forwarders as needed without the requirement for intermediate forwarders unless additional data processing, filtering, or load balancing is required.

Splunk Documentation Reference: Forwarding Data to Splunk Cloud

by Lamonica at Nov 25, 2025, 11:38 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Arlette

1 month ago

B is definitely the best choice. More forwarders, more data!

upvoted 0 times

...

Lawrence

2 months ago

D seems too restrictive. Why limit connections?

upvoted 0 times

...

Renea

2 months ago

I lean towards C. Intermediate Forwarders are safer.

upvoted 0 times

...

Rosina

2 months ago

A sounds right too. Limits can be a concern.

upvoted 0 times

...

Yuki

2 months ago

I agree, B makes sense. Flexibility is key.

upvoted 0 times

...

Dolores

2 months ago

I think B is correct. Unlimited connections are a plus.

upvoted 0 times

...

Cheryll

2 months ago

Just to clarify, A is definitely not true.

upvoted 0 times

...

Margot

3 months ago

Wait, really? I thought you needed an Intermediate Forwarder.

upvoted 0 times

...

Annabelle

3 months ago

Definitely B! That's how it works.

upvoted 0 times

...

Wenona

3 months ago

B is correct! Unlimited Universal Forwarders can connect to Splunk Cloud.

upvoted 0 times

...

Stefanie

4 months ago

Haha, I bet the answer is C. Universal Forwarders are like the middle children of the Splunk family - always getting overlooked!

upvoted 0 times

...

Lashonda

4 months ago

Hmm, I'm going to go with A. Gotta keep those Universal Forwarders under control, you know?

upvoted 0 times

...

Weldon

4 months ago

B is the answer, no doubt. Splunk Cloud is a cloud-based service, so it can handle as many Universal Forwarders as needed.

upvoted 0 times

...

Alfreda

4 months ago

D is the way to go. There's a 3:1 ratio for Universal Forwarders to Intermediate Forwarders.

upvoted 0 times

...

Rozella

4 months ago

C seems more likely to me. Universal Forwarders usually need to send data to an Intermediate Forwarder.

upvoted 0 times

...

Carolynn

4 months ago

I think I saw something about needing one Intermediate Forwarder for every few Universal Forwarders, but I can't remember the exact ratio.

upvoted 0 times

...

Simona

5 months ago

I vaguely recall that Universal Forwarders can send data directly to Splunk Cloud, which might mean option A is incorrect.

upvoted 0 times

...

Danilo

5 months ago

I’m not entirely sure, but I feel like we practiced a question about Intermediate Forwarders, and it mentioned something about needing them for data routing.

upvoted 0 times

...