A Splunk Deployment Server is used to centrally manage and distribute apps, configurations, and updates to deployment clients. On the deployment server, the default location for deployment apps is:
$SPLUNK_HOME/etc/deployment-apps/
Apps placed in this directory can be assigned to server classes and deployed to deployment clients.
Important distinction:
$SPLUNK_HOME/etc/deployment-apps/
is used on the deployment server.
$SPLUNK_HOME/etc/apps/
is where apps are normally installed on a Splunk instance, including deployment clients after apps are received.
manager-apps and peer-apps are not the default Deployment Server app staging directory.
Reference: Splunk Enterprise Updating Splunk Enterprise Instances Manual - deployment server and deployment apps directory; Splunk Enterprise Distributed Deployment Manual - deployment server architecture.

The following items in the phases below are listed in the order Splunk applies them (ie LINE_BREAKER occurs before TRUNCATE).
Input phase
inputs.conf
props.conf
CHARSET
NO_BINARY_CHECK
CHECK_METHOD
CHECK_FOR_HEADER (deprecated)
PREFIX_SOURCETYPE
sourcetype
wmi.conf
regmon-filters.conf
Structured parsing phase
props.conf
INDEXED_EXTRACTIONS, and all other structured data header extractions
Parsing phase
props.conf
LINE_BREAKER, TRUNCATE, SHOULD_LINEMERGE, BREAK_ONLY_BEFORE_DATE, and all other line merging settings TIME_PREFIX, TIME_FORMAT, DATETIME_CONFIG (datetime.xml), TZ, and all other time extraction settings and rules TRANSFORMS which includes per-event queue filtering, per-event index assignment, per-event routing SEDCMD MORE_THAN, LESS_THAN transforms.conf stanzas referenced by a TRANSFORMS clause in props.conf LOOKAHEAD, DEST_KEY, WRITE_META, DEFAULT_VALUE, REPEAT_MATCH Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/ Configurationparametersandthedatapipeline

SAML is an open standard for exchanging authentication and authorization data between parties, especially between an identity provider and a service provider1. SAML supports multi-factor authentication by allowing the identity provider to require the user to present two or more factors of evidence to prove their identity2. For example, the user may need to enter a password and a one-time code sent to their phone, or scan their fingerprint and face.

Reference:https://community.splunk.com/t5/All-Apps-and-Add-ons/How-do-I-configure-a-Splunk-Forwarder- on-Linux/m-p/72078 The CLI command to view the current forwarder to indexer configuration is splunk list forward-server. This command displays the hostnames and port numbers of the indexers that the forwarder sends datato. Therefore, option C is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [Use CLI commands to manage your forwarders - Splunk Documentation]