topic Re: Securing UF-IDX traffic using SSL/TLS in Splunk Practical Lab Exam in Deployment Architecture

Securing UF-IDX traffic using SSL/TLS in Splunk Practical Lab Exam

shabamichae — Sun, 02 Mar 2025 04:22:27 GMT

In the practical Lab environment, how important is it to configure TLS on Splunk servers during the practical Lab. Do i get penalized for not securing UF-IDX traffic using SSL/TLS

Re: Securing UF-IDX traffic using SSL/TLS in Splunk Practical Lab Exam

kiran_panchavat — Sun, 02 Mar 2025 04:37:13 GMT

@shabamichae In the Splunk Architect practical lab exam, configuring TLS/SSL for Universal Forwarder (UF) to Indexer (IDX) communication is not strictly required unless explicitly mentioned in the exam requirements. If the exam explicitly states that secure communication must be configured, then failing to implement SSL/TLS for UF-IDX traffic could result in deductions. Since time is limited, focus on core configurations (indexing, forwarding, clustering, search head deployment) first, then handle TLS if necessary.

Re: Securing UF-IDX traffic using SSL/TLS in Splunk Practical Lab Exam

livehybrid — Sun, 02 Mar 2025 16:16:03 GMT

@kiran_panchavat @shabamichae

This is not strictly true. According to the documentation "Participants then perform a mock deployment according to requirements which adhere to Splunk Deployment Methodology and best-practices." - SSL falls in to best-practice category here for both compression (for data transfer) and security benefits.

Whilst not including SSL between Splunk servers might not result in a failing the the lab, there isnt a zero chance that it wont deduct marks which could affect the final score/outcome. Remember that this is one of the prereqs to Core Consulting certification and at this point it is expected that candidates will apply configuration that is most suitable to the customer.

Splunk Lantern (great for some best-practice guidance) has a good page on SSL: https://lantern.splunk.com/Splunk_Platform/Product_Tips/Administration/Securing_the_Splunk_platform_with_TLS

You can also see more info on enabling SSL at https://docs.splunk.com/Documentation/Splunk/9.4.0/Security/StepstosecuringSplunkwithTLS

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Securing UF-IDX traffic using SSL/TLS in Splunk Practical Lab Exam

isoutamo — Sun, 02 Mar 2025 17:06:10 GMT

Best option is ask is it mandatory or not in that phase.
I’m not sure if this is exactly required or not.