Cribl Source & Destination Configuration 2 — Questions and Answers
Question 1: What is the default port for the Cribl HTTP Source when configured in Splunk HEC compatibility mode?
- 8080
- 9200
- 8088 (Correct answer)
- 514
Correct answer: 8088
Cribl's HTTP Source defaults to port 8088 to match Splunk's HTTP Event Collector (HEC) default port.
Question 2: Which source type should be configured in Cribl to receive data from Splunk Universal Forwarders?
- HTTP Source
- TCP JSON Source
- Splunk TCP Source (Correct answer)
- Beats Source
Correct answer: Splunk TCP Source
The Splunk TCP Source handles the proprietary Splunk forwarder protocol used by Universal Forwarders.
Question 3: When setting up a Kafka source in Cribl, which configuration element is required to identify which data stream to consume?
- Broker port only
- Topic name (Correct answer)
- Consumer group ID only
- Partition offset
Correct answer: Topic name
The topic name is required to tell Cribl which Kafka topic to consume from, along with the broker address.
Question 4: What is the function of an authentication token configured on an HTTP source in Cribl?
- Encrypt data in transit
- Identify the source in routing rules
- Validate and authorize incoming requests (Correct answer)
- Compress event payloads
Correct answer: Validate and authorize incoming requests
The authentication token on an HTTP source validates that incoming requests are authorized, rejecting unauthenticated clients.
Question 5: Which Cribl destination type should you choose to forward processed events directly to a Splunk indexer cluster?
- TCP JSON
- HTTP
- Splunk (Correct answer)
- Syslog
Correct answer: Splunk
The Splunk destination uses the Splunk forwarder protocol to send events directly to Splunk indexers.
Question 6: Which Cribl source type is designed to receive SNMP trap notifications from network devices?
- UDP Source
- TCP Source
- SNMP Trap Source (Correct answer)
- Syslog Source
Correct answer: SNMP Trap Source
Cribl provides a dedicated SNMP Trap Source to receive and parse SNMP trap messages from network equipment.
Question 7: When configuring a Syslog source in Cribl, which transport protocols are supported for receiving log data?
- TCP only
- UDP only
- TCP and UDP (Correct answer)
- TCP, UDP, and SCTP
Correct answer: TCP and UDP
Cribl's Syslog source supports both TCP and UDP transport protocols for receiving syslog messages.
Cribl Source & Destination Configuration 2
What is the default port for the Cribl HTTP Source when configured in Splunk HEC compatibility mode?