Reference:https://github.com/packetiq/SplunkArchitect/blob/master/Install-and-Configure-Splunk-Enterprise- Components.md The Splunk component that requires a separate installation package is the universal forwarder. The universal forwarder is a lightweight Splunk agent that forwards data to indexers or other forwarders. The universal forwarder has a different installation package than the Splunk Enterprise package, which includes all the other Splunk components. Therefore, option C is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [About installing Splunk Enterprise with a universal forwarder - Splunk Documentation]

https://docs.splunk.com/Documentation/Forwarder/8.0.5/Forwarder/Configuretheuniversalforwarder
--Key configuration files are: inputs.conf controls how the forwarder collects data. outputs.conf controls how the forwarder sends data to an indexer or other forwarder server.conf for connection and performance tuning deploymentclient.conf for connecting to a deployment server Reference: https://docs.splunk.com/Documentation/Forwarder/8.0.5/Forwarder/ Configuretheuniversalforwarder

Reference:https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/SetupuserauthenticationwithSplunk Splunk authentication: Provides Admin, Power and User by default, and you can define your own roles using a list of capabilities. If you have an Enterprise license, Splunk authentication is enabled by default. See Set up user authentication with Splunk's built-in system for more information. LDAP: Splunk Enterprise supports authentication with its internal authentication services or your existing LDAP server. See Set up user authentication with LDAP for more information. Scripted authentication API: Use scripted authentication to integrate Splunk authentication with an external authentication system, such as RADIUS or PAM. See Set up user authentication with external systems for more information. Note: Authentication, including native authentication, LDAP, and scripted authentication, is not available in Splunk Free.

The serverclass.conf file controls how deployment apps and configurations are distributed from the Deployment Server to its Deployment Clients. Within this configuration, attribute values can be defined at multiple levels, and Splunk applies them based on a defined order of precedence - from general to most specific.
The correct order of evaluation (lowest to highest precedence) is:
* [global] - applies to all server classes and clients unless overridden.
* [serverClass:<name>] - applies to all clients in that specific server class.
* [serverClass:<name>:app:<appname>] - applies only to a specific app within that server class and overrides previous settings.
This means that values set in the [serverClass:<name>:app:<appname>] stanza take priority over those in
[serverClass:<name>], which in turn override values in [global].
Example (from serverclass.conf):
[global]
whitelist.0 = *
[serverClass:web_servers]
whitelist.0 = web01*
blacklist.0 = test*
[serverClass:web_servers:app:web_monitoring]
restartSplunkWeb = true
Here, restartSplunkWeb = true in the app stanza overrides any inherited setting from the global or class level.
Reference (Splunk Documentation):
* Splunk Enterprise Admin Manual # Deploy configurations using deployment server
* serverclass.conf.spec and example # "Precedence of attributes: global < serverClass:<name> < serverClass:<name>:app:<appname>"
* Splunk Docs: "How the deployment server works"

https://docs.splunk.com/Documentation/Splunk/8.1.3/Security/ConfigureLDAPwithSplunkWeb
"You can map either users or groups, but not both. If you are using groups, all users must be members of an appropriate group. Groups inherit capabilities form the highest level role they're a member of." "If your LDAP environment does not have group entries, you can treat each user as its own group." Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/ConfigureLDAPwithSplunkWeb