Free SPLK-1005 Sample Questions — Splunk Cloud Certified Admin

Splunk Cloud Certified Admin (SPLK-1005) is a admin-level Splunk certification exam. The blueprint splits the exam across 5 domains, starting with Splunk Cloud Architecture, Data Onboarding, User and Role Management. On exam day you face around 75 questions in 75 minutes, in formats such as multiple-choice. The 10 questions below are free samples written to match that style: answer each one first, then reveal the correct answer and note which topics you miss. The SPLK-1005 is rated hard in difficulty, and most candidates prepare with at least 12 months of hands-on experience. Because every answer is revealed in place, you can work through the whole set without leaving this page. Work through all 10 samples before deciding whether to buy the full 35+ question PDF.

  • 10 free questions
  • 75 min
  • $150 official fee
  • Every free question shows the correct answer
  • Questions follow the official 5-domain blueprint
  • No account or email required
  • 35+ questions in the full PDF

Looking for more? Click here to get the full PDF with 35+ practice questions for $5 for offline study and deeper preparation.

Question 1

In case of a Change Request, which of the following should submit a support case for Splunk Support?

  • A. The party requesting the change
  • B. Certified Splunk Cloud administrator
  • C. Splunk infrastructure owner
  • D. Any person with the appropriate entitlement
Show Answer
Correct Answer:
D. Any person with the appropriate entitlement
Question 2

Which of the following files is used for both search-time and index-time configuration?

  • A. inputs.conf
  • B. props.conf
  • C. macros.conf
  • D. savedsearch.conf
Show Answer
Correct Answer:
B. props.conf
Question 3

Windows input types are collected in Splunk via a script which is configurable using the GUI. What is this type of input called?

  • A. Batch
  • B. Scripted
  • C. Modular
  • D. Front-end
Show Answer
Correct Answer:
B. Scripted
Question 4

When is data deleted from a Splunk Cloud index?

  • A. When buckets roll to frozen, without a defined archive
  • B. When data is deleted via the Splunk Cloud Admin GUI
  • C. When TA_Delete is downloaded and enabled from SplunkBase
  • D. When the deleteindex command is executed from the CLI
Show Answer
Correct Answer:
A. When buckets roll to frozen, without a defined archive
Question 5

Where does the regex-replacement processor run?

  • A. Merging pipeline
  • B. Typing pipeline
  • C. Index pipeline
  • D. Parsing pipeline
Show Answer
Correct Answer:
B. Typing pipeline
Question 6

In what scenarios would transforms.conf be used?

  • A. Per-Event Index Routing, Applying Event Types, SEDCMD operations
  • B. Per-Event Sourcetype, Per-Event Host Name, Per-Event Index Routing
  • C. Per-Event Host Name, Per-Event Index Routing, SEDCMD operations
  • D. Per-Event Sourcetype, Per-Event Index Routing, Applying Event Types
Show Answer
Correct Answer:
B. Per-Event Sourcetype, Per-Event Host Name, Per-Event Index Routing
Question 7

Which of the following methods is valid for creating index-time field extractions?

  • A. Use the UI to create a sourcetype, specify the field name and corresponding regular expression with capture statement
  • B. Create a configuration app with the index-time props.conf and/or transforms.conf, and upload the app via UI
  • C. Use the CLI app to define settings in fields.conf, and restart Splunk Cloud
  • D. Use the rex command to extract the desired field, and then save as a calculated field
Show Answer
Correct Answer:
B. Create a configuration app with the index-time props.conf and/or transforms.conf, and upload the app via UI
Question 8

Which of the following is correct in regard to configuring a Universal Forwarder as an Intermediate Forwarder?

  • A. This can only be turned on using the Settings > Forwarding and Receiving menu in Splunk Web/UI
  • B. The configuration changes can be made using Splunk Web, CLI, directly in configuration files, or via a deployment app
  • C. The configuration changes can be made using CLI, directly in configuration files, or via a deployment app
  • D. It is only possible to make this change directly in configuration files or via a deployment app
Show Answer
Correct Answer:
C. The configuration changes can be made using CLI, directly in configuration files, or via a deployment app
Question 9

A monitor has been created in inputs.conf for a directory that contains a mix of file types. How would a Cloud Admin fine-tune assigned sourcetypes for different files in the directory during the input phase?

  • A. On the Indexer parsing the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza
  • B. On the forwarder collecting the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza
  • C. On the Indexer parsing the data, set multiple sourcetype_source attributes for the directory monitor collecting the files. Then create a props.conf that filters out unwanted files
  • D. On the forwarder collecting the data, set multiple sourcetype_source attributes for the directory monitor collecting the files. Then create a props.conf that filters out unwanted files
Show Answer
Correct Answer:
B. On the forwarder collecting the data, leave sourcetype as automatic for the directory monitor. Then create a props.conf that assigns a specific sourcetype by source stanza
Question 10

What is the recommended method to test the onboarding of a new data source before putting it in production?

  • A. Send test data to a test index
  • B. Send data to the associated production index
  • C. Replicate Splunk deployment in a test environment
  • D. Send data to lastchanceindex
Show Answer
Correct Answer:
A. Send test data to a test index

SPLK-1005 sample questions FAQ

Are these SPLK-1005 sample questions from the real exam?

No. They are original practice questions written to match the format and topic mix of the Splunk Cloud Certified Admin exam, which contains around 75 questions. Treat them as representative practice, not leaked exam content.

How many free SPLK-1005 sample questions do I get?

This page includes 10 questions, each with its correct answer you can reveal in place. The full study PDF expands that to 35+ questions.

Do the sample questions include the correct answers?

Yes. Open the answer panel under each question to see which option is correct. Answer first, then reveal, so the set works as a self-check rather than a reading exercise.

Is 10 sample questions enough to pass the SPLK-1005?

Not on its own. Use the samples to find weak topics, revise them against the official domains, then work through the full 35+ question set under timed conditions before booking the exam.

Aced these? Get the Full Exam

Download the complete SPLK-1005 study bundle with 35+ questions in a single printable PDF.

Purchase Full Exam PDF | $5