because transforms.conf is the right configuration file to state the regex expression.https://docs.splunk.com
/Documentation/Splunk/8.1.0/Admin/Transformsconf
Reference: https://community.splunk.com/t5/Archive/How-to-mask-SSN-into-our-logs-going-into-Splunk/tdp/
433035

The answer to your question is C. services/data/collector. This is the endpoint URI used to collect data in a customer managed Splunk Enterprise environment.According to the Splunk documentation1, "The HTTP Event Collector REST API endpoint is /services/data/collector.You can use this endpoint to send events to HTTP Event Collector on a Splunk Enterprise or Splunk Cloud Platform deployment." You can also use this endpoint to send events to a specific token or index1. For example, you can use the following curl command to send an event with the token 578254cc-05f5-46b5-957b-910d1400341a and the index main:
curl -k https://localhost:8088/services/data/collector -H'Authorization: Splunk 578254cc-05f5-46b5-957b-
910d1400341a'-d'{"index":"main","event":"Hello, world!"}'

Reference:https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-configure-a-Splunk-Forwarder- on-Linux/m-p/72078 The CLI command to view the current forwarder to indexer configuration is splunk list forward-server. This command displays the hostnames and port numbers of the indexers that the forwarder sends datato. Therefore, option C is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [Use CLI commands to manage your forwarders - Splunk Documentation]

Reference:https://docs.splunk.com/Documentation/SplunkCloud/latest/Data
/Bypassautomaticsourcetypeassignment
When using a directory monitor input, specific source types can be selectively overridden using props.conf.
The props.conf file contains settings for parsing and indexing data, as well as search-time field extractions.
The props.conf file can be used to assign or change source types for specific inputs using the sourcetype attribute. Therefore, option A is the correct answer. References: Splunk Enterprise Certified Admin | Splunk,
[Configure directory monitor inputs - Splunk Documentation]