Splunk Enterprise Certified Admin Practice Test

Which forwarder is capable of data masking before sending it to transmitting indexers?

1. Universal Forwarder

2. Light Forwarder

3. Heavy Forwarder

4. Data Forwarder

The correct answer is: Heavy Forwarder

The Heavy Forwarder is capable of performing data masking before it transmits data to indexers. This is a critical feature because it allows organizations to protect sensitive information by modifying or hiding specific data elements during the forwarding process. Heavy Forwarders have robust data processing capabilities, including the ability to parse, filter, and transform data. In contrast, the Universal Forwarder is primarily designed for lightweight data collection and does not have the advanced processing capabilities of a Heavy Forwarder, thus lacking the ability to perform data masking. The Light Forwarder, a less common term, typically refers to similar lightweight functionality but does not apply in this context. The option labeled "Data Forwarder" is not a standard term in Splunk terminology, leading to ambiguity, while Heavy Forwarders explicitly offer the features required for data masking.