* Data integrity controls in Splunk ensure that indexed data has not been tampered with.
* When enabled, Splunk calculates hashes for each bucket and stores these hash files in the rawdata directory of the corresponding bucket.
* Incorrect Options:
* A, C, D:These directories do not store hash files.
References:
Splunk Docs: Configure data integrity controls

The Data Preview feature should be used when validating the parsing of data. The Data Preview feature allows you to preview how Splunk software will index your data before you commit the data to an index. You can use the Data Preview feature to check the following aspects of data parsing1:
Timestamp recognition: You can verify that Splunk software correctly identifies the timestamps of your events and assigns them to the _time field.
Event breaking: You can verify that Splunk software correctly breaks your data stream into individual events based on the line breaker and should linemerge settings.
Source type assignment: You can verify that Splunk software correctly assigns a source type to your data based on the props.conf file settings. You can also manually override the source type if needed.
Field extraction: You can verify that Splunk software correctly extracts fields from your events based on the transforms.conf file settings. You can also use the Interactive Field Extractor (IFX) to create custom field extractions.
The Data Preview feature is available in Splunk Web under Settings > Data inputs > Data preview. You can access the Data Preview feature when you add a new input or edit an existing input1.
The other options are incorrect because:
A) When extracting fields for ingested data. The Data Preview feature can be used to verify the field extraction for data that has not been ingested yet, but not for data that has already been indexed. To extract fields from ingested data, you can use the IFX or the rex command in the Search app2.
B) When previewing the data before searching. The Data Preview feature does not allow you to search the data, but only to view how it will be indexed. To preview the data before searching, you can use the Search app and specify a time range or a sample ratio.
C) When reviewing data on the source host. The Data Preview feature does not access the data on the source host, but only the data that has been uploaded or monitored by Splunk software. To review data on the source host, you can use the Splunk Universal Forwarder or the Splunk Add-on for Unix and Linux.

When configuring multiple LDAP strategies in Splunk, the order in which they are listed in the authentication.
conf file determines the sequence in which Splunk searches them during authentication.
From the official Splunk documentation:
"To configure multiple LDAP strategies, set the authSettings setting to a comma-separated list of all strategies, in the order in which you want to query the strategies."
- Configure LDAP using configuration files - Splunk Documentation
Therefore, Splunk will search each LDAP strategy in the order specified in the authSettings parameter of the authentication.conf file.
Reference:
Configure LDAP using configuration files - Splunk Documentation

Search-time field extractions are the process of extracting fields from events after they are indexed. Search- time field extractions are specified on the search head, which is the Splunk component that handles searching and reporting. Search-time field extractions are configured in props.conf and transforms.conf files, which are located in the etc/system/local directory on the search head. Therefore, option D is the correct answer.
References: Splunk Enterprise Certified Admin | Splunk, [About fields - Splunk Documentation]