Free SPLK-1005 mock test – Exam 1

Splunk Cloud Certified Admin

Free SPLK-1005 practice exam for Splunk certification prep.

Use this free SPLK-1005 practice exam to review Splunk Cloud topology, indexes, users, authentication, forwarders, inputs, HEC, parsing, apps, and support workflows.

10 exam-style questionsQuiz Maker examDetailed option explanationsNo signup required

Start Practice Exam 1 below. Answer each question first, then review the detailed explanations for every option.

SPLK-1005 Practice Exam 1

Free SPLK-1005 practice exam 1 for the Splunk Cloud Certified Admin certification with 10 original scenario questions and detailed explanations.

1 / 10

Question

A company is moving from Splunk Enterprise to Splunk Cloud. Which responsibility normally shifts away from the customer?

Which option best meets the requirement?

A. Creating knowledge objects for their own users.

B. Maintaining the Splunk Cloud platform infrastructure and core managed service components.

C. Choosing which business data sources to ingest.

D. Defining role access for their organization.

Correct Answer: B

Explanation

A. Incorrect.
Customers still manage their own searches, reports, dashboards, and knowledge objects. In easy words, option A may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
B. Correct.
This is the best answer because Splunk Cloud changes the platform operations model by moving managed infrastructure responsibility to Splunk. In easy words, option B matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
C. Incorrect.
Customers still decide which data sources are required for their use cases. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
Cloud administrators still manage users, roles, and access within the tenant. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.

Correct Answer: B

Explanation

A. Incorrect.
Customers still manage their own searches, reports, dashboards, and knowledge objects. In easy words, option A may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
B. Correct.
This is the best answer because Splunk Cloud changes the platform operations model by moving managed infrastructure responsibility to Splunk. In easy words, option B matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
C. Incorrect.
Customers still decide which data sources are required for their use cases. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
Cloud administrators still manage users, roles, and access within the tenant. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.

Correct Answer: B

Explanation

A. Incorrect.
Customers still manage their own searches, reports, dashboards, and knowledge objects. In easy words, option A may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
B. Correct.
This is the best answer because Splunk Cloud changes the platform operations model by moving managed infrastructure responsibility to Splunk. In easy words, option B matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
C. Incorrect.
Customers still decide which data sources are required for their use cases. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
Cloud administrators still manage users, roles, and access within the tenant. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.

2 / 10

Question

A Splunk Cloud administrator needs a new index for application logs with a specific retention requirement. What should they configure?

Which option best meets the requirement?

A. Create an index with the required name, datatype, and retention settings appropriate for the data.

B. Create a dashboard panel and let Splunk automatically make the index.

C. Put the index name only in a search macro.

D. Delete the main index so the new data has somewhere to go.

3 / 10

Question

A team accidentally ingested sensitive test data into a Splunk Cloud index. What should the administrator understand about deleting it?

Which option best meets the requirement?

A. Any search user can permanently delete indexed data with a dashboard button.

B. Deleting a dashboard panel deletes the indexed events.

C. Changing the sourcetype removes already indexed raw data.

D. Data deletion requires the appropriate capability/process and should be handled carefully because indexed data removal is controlled.

4 / 10

Question

An auditor asks who can run searches against a restricted index. Which configuration should the admin review first?

Which option best meets the requirement?

A. Only the color theme for dashboards.

B. Only deploymentclient.conf on forwarders.

C. Roles and index access capabilities assigned to users or groups.

D. Only the line-breaking settings in props.conf.

5 / 10

Question

A company wants users to authenticate to Splunk Cloud using its identity provider and group mappings. Which integration is most relevant?

Which option best meets the requirement?

A. A monitor input.

B. SAML, LDAP, or Active Directory integration depending on the supported identity architecture.

C. SEDCMD on the raw events.

D. A TCP network input only.

Correct Answer: B

Explanation

A. Incorrect.
Monitor inputs collect files and directories; they do not authenticate users. In easy words, option A may sound related, but it does not fix the actual requirement in this question. The question is testing identity or asset context in Enterprise Security, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
B. Correct.
This is the best answer because The blueprint covers integrating Splunk with LDAP, Active Directory, or SAML. In easy words, option B matches what the question is asking you to do with identity or asset context in Enterprise Security. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
C. Incorrect.
SEDCMD modifies raw event text during parsing and is unrelated to authentication. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing identity or asset context in Enterprise Security, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
TCP inputs collect data and do not integrate identity providers. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing identity or asset context in Enterprise Security, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.

Correct Answer: B

Explanation

A. Incorrect.
Monitor inputs collect files and directories; they do not authenticate users. In easy words, option A may sound related, but it does not fix the actual requirement in this question. The question is testing identity or asset context in Enterprise Security, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
B. Correct.
This is the best answer because The blueprint covers integrating Splunk with LDAP, Active Directory, or SAML. In easy words, option B matches what the question is asking you to do with identity or asset context in Enterprise Security. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
C. Incorrect.
SEDCMD modifies raw event text during parsing and is unrelated to authentication. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing identity or asset context in Enterprise Security, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
TCP inputs collect data and do not integrate identity providers. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing identity or asset context in Enterprise Security, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.

Correct Answer: B

Explanation

A. Incorrect.
Monitor inputs collect files and directories; they do not authenticate users. In easy words, option A may sound related, but it does not fix the actual requirement in this question. The question is testing identity or asset context in Enterprise Security, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
B. Correct.
This is the best answer because The blueprint covers integrating Splunk with LDAP, Active Directory, or SAML. In easy words, option B matches what the question is asking you to do with identity or asset context in Enterprise Security. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
C. Incorrect.
SEDCMD modifies raw event text during parsing and is unrelated to authentication. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing identity or asset context in Enterprise Security, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
TCP inputs collect data and do not integrate identity providers. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing identity or asset context in Enterprise Security, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.

6 / 10

Question

An app contains props.conf settings at multiple layers. Which principle decides which setting wins?

Which option best meets the requirement?

A. Splunk configuration file precedence based on app, user, local, and default context.

B. The newest dashboard panel always overrides configuration files.

C. The longest sourcetype name always wins.

D. Forwarder CPU usage determines precedence.

7 / 10

Question

A field extraction is needed only when users search the data, not before indexing. Which process does this describe?

Which option best meets the requirement?

A. Index-time queue routing only.

B. License stack creation.

C. Forwarder deployment polling.

D. Search-time processing.

Correct Answer: D

Explanation

A. Incorrect.
Queue routing affects index-time data flow, not search-time field extraction. In easy words, option A may sound related, but it does not fix the actual requirement in this question. The question is testing field extraction, field selection, or field-based filtering, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
B. Incorrect.
License stacks are unrelated to field extraction timing. In easy words, option B may sound related, but it does not fix the actual requirement in this question. The question is testing field extraction, field selection, or field-based filtering, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
C. Incorrect.
Deployment polling distributes apps/configurations and is not field extraction timing. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing field extraction, field selection, or field-based filtering, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Correct.
This is the best answer because Search-time processing creates fields and knowledge when searches run. In easy words, option D matches what the question is asking you to do with field extraction, field selection, or field-based filtering. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.

Correct Answer: D

Explanation

A. Incorrect.
Queue routing affects index-time data flow, not search-time field extraction. In easy words, option A may sound related, but it does not fix the actual requirement in this question. The question is testing field extraction, field selection, or field-based filtering, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
B. Incorrect.
License stacks are unrelated to field extraction timing. In easy words, option B may sound related, but it does not fix the actual requirement in this question. The question is testing field extraction, field selection, or field-based filtering, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
C. Incorrect.
Deployment polling distributes apps/configurations and is not field extraction timing. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing field extraction, field selection, or field-based filtering, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Correct.
This is the best answer because Search-time processing creates fields and knowledge when searches run. In easy words, option D matches what the question is asking you to do with field extraction, field selection, or field-based filtering. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.

Correct Answer: D

Explanation

A. Incorrect.
Queue routing affects index-time data flow, not search-time field extraction. In easy words, option A may sound related, but it does not fix the actual requirement in this question. The question is testing field extraction, field selection, or field-based filtering, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
B. Incorrect.
License stacks are unrelated to field extraction timing. In easy words, option B may sound related, but it does not fix the actual requirement in this question. The question is testing field extraction, field selection, or field-based filtering, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
C. Incorrect.
Deployment polling distributes apps/configurations and is not field extraction timing. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing field extraction, field selection, or field-based filtering, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Correct.
This is the best answer because Search-time processing creates fields and knowledge when searches run. In easy words, option D matches what the question is asking you to do with field extraction, field selection, or field-based filtering. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.

8 / 10

Question

An administrator notices that daily indexed volume is rising unexpectedly. What should they monitor first?

Which option best meets the requirement?

A. Only the CSS file for dashboards.

B. Only user login theme settings.

C. Indexing activity, source/sourcetype/index volume, and recent input or forwarder changes.

D. Only whether a lookup is case-sensitive.

9 / 10

Question

A team asks whether Splunk Cloud and Splunk Enterprise are administered exactly the same way. What is the best answer?

Which option best meets the requirement?

A. Yes. Cloud admins always get operating system access to every indexer.

B. No. Splunk Cloud is a managed service, so platform-level responsibilities and access differ from self-managed Enterprise.

C. Yes. Forwarders are not used with Splunk Cloud.

D. No. Splunk Cloud cannot use indexes or user roles.

Correct Answer: B

Explanation

A. Incorrect.
Splunk Cloud does not generally provide the same OS-level control as self-managed Enterprise. In easy words, option A may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
B. Correct.
This is the best answer because Cloud and Enterprise share many concepts, but the operating model and responsibilities differ. In easy words, option B matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
C. Incorrect.
Forwarders are commonly used to send data to Splunk Cloud. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
Splunk Cloud uses indexes and roles. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.

Correct Answer: B

Explanation

A. Incorrect.
Splunk Cloud does not generally provide the same OS-level control as self-managed Enterprise. In easy words, option A may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
B. Correct.
This is the best answer because Cloud and Enterprise share many concepts, but the operating model and responsibilities differ. In easy words, option B matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
C. Incorrect.
Forwarders are commonly used to send data to Splunk Cloud. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
Splunk Cloud uses indexes and roles. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.

Correct Answer: B

Explanation

A. Incorrect.
Splunk Cloud does not generally provide the same OS-level control as self-managed Enterprise. In easy words, option A may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
B. Correct.
This is the best answer because Cloud and Enterprise share many concepts, but the operating model and responsibilities differ. In easy words, option B matches what the question is asking you to do with the specific Splunk feature or workflow in the question. The key clue is that this choice directly solves the requirement without adding extra configuration that is not needed. On the exam, choose this kind of answer when the scenario asks for the normal Splunk feature or workflow for this situation.
C. Incorrect.
Forwarders are commonly used to send data to Splunk Cloud. In easy words, option C may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.
D. Incorrect.
Splunk Cloud uses indexes and roles. In easy words, option D may sound related, but it does not fix the actual requirement in this question. The question is testing the specific Splunk feature or workflow in the question, and this answer points to a different task, a weaker shortcut, or an action that would not solve the user's problem. On the exam, eliminate answers like this when they do not directly match the scenario.

10 / 10

Question

A customer in Managed Cloud needs a restricted platform change that is not exposed in self-service controls. What should the admin do?

Which option best meets the requirement?

A. Isolate the issue, gather evidence, then work with Splunk Cloud Support through the proper process.

B. Attempt unsupported shell access to managed indexers.

C. Delete all private apps to force the change.

D. Ask every search user to run the same admin command.

Your score is

The average score is 0%

What Practice Exam 1 covers

Splunk Cloud topology, administrator tasks, and differences from Splunk Enterprise
Self-Service Cloud versus Managed Cloud responsibilities and support boundaries
Index creation, retention planning, data deletion, and indexing activity monitoring
User roles, authorization, LDAP, Active Directory, and SAML integration
Configuration file precedence plus index-time and search-time processing

Who should take this free mock test

Use this SPLK-1005 practice exam if you are preparing for the Splunk Cloud Certified Admin certification and want scenario-based review with detailed explanations.

Browse Splunk practice exams Visit DevOpsEngine

FAQ

Is this SPLK-1005 practice exam free?

Yes. This Splunk Cloud Certified Admin mock test is free to open and retake.

Does this practice exam use Quiz Maker?

Yes. The questions are published as a Quiz Maker exam with answer checking and detailed explanations.

Are these official Splunk exam questions?

No. These are original independent practice questions for study and review, not official Splunk exam materials.

Free SPLK-1005 practice exam for Splunk certification prep.

Question

Correct Answer: B

Explanation

Correct Answer: B

Explanation

Correct Answer: B

Explanation

Question

Correct Answer: A

Explanation

Correct Answer: A

Explanation

Correct Answer: A

Explanation

Question

Correct Answer: D

Explanation

Correct Answer: D

Explanation

Correct Answer: D

Explanation

Question

Correct Answer: C

Explanation

Correct Answer: C

Explanation

Correct Answer: C

Explanation

Question

Correct Answer: B

Explanation

Correct Answer: B

Explanation

Correct Answer: B

Explanation

Question

Correct Answer: A

Explanation

Correct Answer: A

Explanation

Correct Answer: A

Explanation

Question

Correct Answer: D

Explanation

Correct Answer: D

Explanation

Correct Answer: D

Explanation

Question

Correct Answer: C

Explanation

Correct Answer: C

Explanation

Correct Answer: C

Explanation

Question

Correct Answer: B

Explanation

Correct Answer: B

Explanation

Correct Answer: B

Explanation

Question

Correct Answer: A

Explanation

Correct Answer: A

Explanation

Correct Answer: A

Explanation

What Practice Exam 1 covers

Who should take this free mock test

FAQ

Is this SPLK-1005 practice exam free?

Does this practice exam use Quiz Maker?

Are these official Splunk exam questions?