A Heavy Forwarder is a Splunk instance that can parse and filter data before forwarding it to another Splunk instance, such as an indexer1. A Heavy Forwarder can also perform index-time field extractions using the TRANSFORMS setting2.
The TRANSFORMS setting is used to configure data transformations in the transforms.conf file3. The transforms.conf file contains settings and values that you can use to configure host and source type overrides, anonymize sensitive data, route events to different indexes, create index-time and search-time field extractions, and set up lookup tables3.
The TRANSFORMS setting can be deployed to the Heavy Forwarder where the syslog files are being monitored, so that the logs can be rerouted based on the event message before they are forwarded to the indexer2. This can improve the performance and efficiency of data processing and indexing2.

Reference:https://github.com/packetiq/SplunkArchitect/blob/master/Install-and-Configure-Splunk-Enterprise- Components.md The Splunk component that requires a separate installation package is the universal forwarder. The universal forwarder is a lightweight Splunk agent that forwards data to indexers or other forwarders. The universal forwarder has a different installation package than the Splunk Enterprise package, which includes all the other Splunk components. Therefore, option C is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [About installing Splunk Enterprise with a universal forwarder - Splunk Documentation]

Splunk checks role-to-group mapping only during user login for external authentication (e.g., LDAP, SAML).
Users already logged in will continue using their previously assigned roles until they log out and log back in.
The changes to role mapping do not disrupt ongoing sessions.
Incorrect Options:
B:Search is not disabled upon role updates.
C:This is incorrect since existing users are also updated upon the next login.
D:Role updates do not terminate ongoing sessions.
References:
Splunk Docs: Configure user authentication

Reference:https://docs.splunk.com/Documentation/SplunkCloud/8.2.2105/Security
/SetupuserauthenticationwithLDAP
Splunk platform attempts native authentication first. If authentication fails outside of a local account that doesn't exist, there is no attempt to use LDAP to log in. This is adapted from precedence of Splunk authentication schema.