D AND B Compressing data is the answer.

B and D both: compressed=true This tells the forwarder to compress the data before it forwards the data to receiving indexers in the target groups. If you set compressed to "false", the forwarder sends raw data. Splunk doc: https://docs.splunk.com/Documentation/Forwarder/8.1.1/Forwarder/Configureforwardingwithoutputs.conf#:~:text=compressed%3Dtrue%20This%20tells%20the,the%20forwarder%20sends%20raw%20data.

The capabilities of a universal forwarder when sending data include: B. Compressing data D. Indexer acknowledgement Explanation: - **Compressing data**: Universal forwarders can compress data before sending it to reduce bandwidth usage. - **Indexer acknowledgement**: They can confirm receipt of data by the indexer to ensure data integrity and completeness in the indexing process. < https://bitly.cx/NyKD > I passed my SPLK exam with ease thanks to you. The dumps were accurate and the explanations were clear.

B and D is correct . C(masking) can be done with the Heavy Forwarder not the Universal. Universal only parses data.

B and D are correct

I think C is also correct. https://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedata "To anonymize data with Splunk Enterprise, you must configure a Splunk Enterprise instance as a heavy forwarder and anonymize the incoming data with that instance before sending it to Splunk Enterprise."

B & D are the answers

UF has the following capabilities: - Index ack* (useACK=true in outputs.conf) - Send data over HTTP - Compressing the feed (compressed = true on both input.conf (indexer) and outputs.conf (uf)) - Securing the feed with SSL So, D and B C. that would be a HF A. not sure if Forwarders in general can send alerts

Answer is B

B AND D !!!

B. Compressing data D. Indexer acknowledgement System Admin course, page 182

B and D are correct

Data Admin - Slide 65

Ans is B&D