Objective 7.2
Enterprise Certified AdminList Splunk forwarder types
Objective 7.2 sits in Getting Data In, which carries 5% of the Enterprise Certified Admin exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
You are writing a build guide and need the complete set of forwarder types the platform documents, not just the one you deploy. How many types are there?
Correct.
Checked against help.splunk.com, August 2026Concept
Two are in current use and one is deprecated, which is why the count and the recommendation differ. Knowing all three keeps older documentation readable.
Why D
Splunk states that there are three types of forwarders: the universal forwarder, the heavy forwarder and the light forwarder.
Source
Splunk Docs: Types of forwarders, checked August 2026There are three types of forwarders: The universal forwarder contains only the components that are necessary to forward data.
Now you: objective 7.2 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 2
You need one forwarding tier to mask card numbers before the data reaches your indexers, and a universal forwarder cannot do it. What can a heavy forwarder do besides forward?
Sample question 2 of 2
An administrator finds a light forwarder in an old deployment. What does Splunk say about it?
Full Enterprise Certified Admin question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.