Splunk SPLK-3003 Exam - Topic 3 Question 16 Discussion

Actual exam question for Splunk's SPLK-3003 exam

Question #: 16
Topic #: 3

A customer has a network device that transmits logs directly with UDP or TCP over SSL. Using PS best practices, which ingestion method should be used?

AOpen a TCP port with SSL on a heavy forwarder to parse and transmit the data to the indexing tier.

BOpen a UDP port on a universal forwarder to parse and transmit the data to the indexing tier.

CUse a syslog server to aggregate the data to files and use a heavy forwarder to read and transmit the data to the indexing tier.

DUse a syslog server to aggregate the data to files and use a universal forwarder to read and transmit the data to the indexing tier.

Show Suggested Answer

Suggested Answer: D

by My at May 05, 2022, 11:53 AM

Limited Time Offer

25%

Off

Get Premium SPLK-3003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lili

5 months ago

Wait, can you really use UDP with SSL? That sounds sketchy!

upvoted 0 times

...

Sharmaine

5 months ago

D sounds interesting, but is it really the best option?

upvoted 0 times

...

Elly

6 months ago

C seems outdated, why not just use a heavy forwarder?

upvoted 0 times

...

Buffy

6 months ago

I think B could work too, but not as secure.

upvoted 0 times

...

Kate

6 months ago

Definitely A, SSL over TCP is the way to go!

upvoted 0 times

...

Micaela

6 months ago

I’m leaning towards option C because it talks about using a syslog server, but I’m not confident about whether that’s the best practice for SSL logs.

upvoted 0 times

...

Dorethea

6 months ago

I'm not entirely sure, but I remember something about UDP being less reliable. Maybe option B isn't the best choice?

upvoted 0 times

...

Brandon

6 months ago

I think we should go with option A since it mentions using TCP with SSL, which seems more secure for log transmission.

upvoted 0 times

...

Brandon

6 months ago

I feel like we've seen a similar question before, and I think using a heavy forwarder is usually the right move. So, option A sounds good to me.

upvoted 0 times

...

Levi

6 months ago

This looks like a straightforward question about defining testable acceptance criteria. I'll focus on identifying the criteria that can be objectively verified.

upvoted 0 times

...

Gail

6 months ago

I'm pretty sure the answer is A. The question specifically mentions "did_url_mappings/2.0", and the file "GVPOwner_Admin_.xml" seems like it would be an example of a file installed in that directory.

upvoted 0 times

...

King

6 months ago

I'm a bit confused—wasn't there some discussion about SOAP vs. REST? I feel like HTTP is the answer, but not 100% confident.

upvoted 0 times

...