Splunk Enterprise Certified Admin Practice Test

Which of the following is NOT true about the index data integrity check?

1. It provides a way to validate that data has not been tampered with after indexing.

2. It produces calculated hash files for auditing and legal purposes.

3. It protects data in-flight from forwarders.

4. It works on the index level (including clustering).

The correct answer is: It protects data in-flight from forwarders.

The chosen answer indicates that the statement about protecting data in-flight from forwarders is not true regarding the index data integrity check. This assertion reflects an important aspect of how the data integrity check operates within Splunk's architecture. The index data integrity check primarily focuses on validating the integrity of data that has already been indexed in Splunk. It achieves this by producing hash values that can be used to confirm that data has not been altered after it has been stored in the index, which is crucial for maintaining data authenticity and ensuring that it can be relied upon for auditing and legal considerations. While the index data integrity check ensures data integrity at the index level, it is not responsible for the security of data as it is being transmitted from forwarders to the Splunk indexers. The protection of data in-flight, such as encryption and secure transport, is handled by other mechanisms (for example, using SSL/TLS), which are separate from the integrity checks that occur post-indexing. This distinction clarifies why the statement about in-flight data protection does not accurately describe the function of the index data integrity check, making it the correct choice in this scenario.