Splunk Enterprise Certified Admin Practice Test

Which two types of Windows inputs can be collected remotely using WMI without installing a Splunk forwarder?

1. System logs and Application logs

2. Event logs and Performance monitor

3. Security logs and Activity logs

4. Only Performance monitor

The correct answer is: Event logs and Performance monitor

The correct choice highlights the two types of Windows inputs that can be gathered remotely using Windows Management Instrumentation (WMI) — specifically event logs and performance monitor data. WMI is a powerful Windows feature that allows for interaction with various system management data, ensuring that information about the system can be accessed without having to go through the process of installing additional software like the Splunk forwarder on each machine. Event logs are a critical part of system monitoring as they record events occurring on the operating system and applications, which can provide insights into system behavior, security, and failures. Performance monitor data, on the other hand, provides real-time metrics regarding various system performance aspects, such as CPU usage, memory usage, and network statistics. Collecting this data via WMI allows administrators to monitor system health effectively and troubleshoot issues without direct access to the systems. Other choices contain inputs that either do not align with what WMI can collect remotely or combine types that do not summarize the most relevant inputs collected in this context. For instance, system logs and application logs, while they may provide valuable information, typically require direct access or a forwarder for collection, thus not matching the remote capability offered by WMI in this scenario.