Securing UF-IDX traffic using SSL/TLS in Splunk Practical Lab Exam

[shabamichae]

In the practical Lab environment, how important is it to configure TLS on Splunk servers during the practical Lab. Do i get penalized for not securing UF-IDX traffic using SSL/TLS 

[kiran_panchavat · Accepted solution]

@shabamichae In the Splunk Architect practical lab exam, configuring TLS/SSL for Universal Forwarder (UF) to Indexer (IDX) communication is not strictly required unless explicitly mentioned in the exam requirements. If the exam explicitly states that secure communication must be configured, then failing to implement SSL/TLS for UF-IDX traffic could result in deductions. Since time is limited, focus on core configurations (indexing, forwarding, clustering, search head deployment) first, then handle TLS if necessary.

[livehybrid]

@kiran_panchavat  @shabamichae 

This is not strictly true. According to the documentation "Participants then perform a mock deployment according to requirements which adhere to Splunk Deployment Methodology and best-practices." - SSL falls in to best-practice category here for both compression (for data transfer) and security benefits.

Whilst not including SSL between Splunk servers might not result in a failing the the lab, there isnt a zero chance that it wont deduct marks which could affect the final score/outcome. Remember that this is one of the prereqs to Core Consulting certification and at this point it is expected that candidates will apply configuration that is most suitable to the customer.

Splunk Lantern (great for some best-practice guidance) has a good page on SSL: https://lantern.splunk.com/Splunk_Platform/Product_Tips/Administration/Securing_the_Splunk_platform_...

You can also see more info on enabling SSL at https://docs.splunk.com/Documentation/Splunk/9.4.0/Security/StepstosecuringSplunkwithTLS

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[isoutamo]

Best option is ask is it mandatory or not in that phase.
I’m not sure if this is exactly required or not.