SPLK-2002 practice questions 1–10

1. Question 1 · 167 in bank

   Select 2

   Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)

   • AAdding search peers increases the maximum size of search results.
   • BAdding RAM to an existing search heads provides additional search capacity.
   • CAdding search peers increases the search throughput as search load increases.
   • DAdding search heads provides additional CPU cores to run more concurrent searches.

   Show answer

   Answer: CD

   Next question

2. Question 2 · 167 in bank

   Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?

   • ASetting the cluster search factor to N-1.
   • BIncreasing the number of buckets per index.
   • CDecreasing the data model acceleration range.
   • DSetting the cluster replication factor to N-1.

   Show answer

   Answer: A

   Next question

3. Question 3 · 167 in bank

   Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

   • AIncreasing the search factor in the cluster.
   • BIncreasing the replication factor in the cluster.
   • CIncreasing the number of search heads in the cluster.
   • DIncreasing the number of CPUs on the indexers in the cluster.

   Show answer

   Answer: A

   Next question

4. Question 4 · 167 in bank

   In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files. What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?

   • ATotal daily indexing volume, number of peer nodes, and number of accelerated searches.
   • BTotal daily indexing volume, number of peer nodes, replication factor, and search factor.
   • CTotal daily indexing volume, replication factor, search factor, and number of search heads.
   • DReplication factor, search factor, number of accelerated searches, and total disk size across cluster.

   Show answer

   Answer: B

   Next question

5. Question 5 · 167 in bank

   Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search performance improvement?

   • AReplace the indexer storage to solid state drives (SSD).
   • BAdd more search heads and redistribute users based on the search type.
   • CLook for slow searches and reschedule them to run during an off-peak time.
   • DAdd more search peers and make sure forwarders distribute data evenly across all indexers.

   Show answer

   Answer: D

   Next question

6. Question 6 · 167 in bank

   What is the minimum reference server specification for a Splunk indexer?

   • A12 CPU cores, 12GB RAM, 800 IOPS
   • B16 CPU cores, 16GB RAM, 800 IOPS
   • C24 CPU cores, 16GB RAM, 1200 IOPS
   • D28 CPU cores, 32GB RAM, 1200 IOPS

   Show answer

   Answer: A

   Next question

7. Question 7 · 167 in bank

   A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining that the events are inconsistently formatted for a web sourcetype. Further investigation reveals that not all web logs flow through the same infrastructure: some of the data goes through heavy forwarders and some of the forwarders are managed by another department. Which of the following items might be the cause for this issue?

   • AThe search head may have different configurations than the indexers.
   • BThe data inputs are not properly configured across all the forwarders.
   • CThe indexers may have different configurations than the heavy forwarders.
   • DThe forwarders managed by the other department are an older version than the rest.

   Show answer

   Answer: C

   Next question

8. Question 8 · 167 in bank

   Select 3

   To optimize the distribution of primary buckets; when does primary rebalancing automatically occur? (Select all that apply.)

   • ARolling restart completes.
   • BMaster node rejoins the cluster.
   • CCaptain joins or rejoins cluster.
   • DA peer node joins or rejoins the cluster.

   Show answer

   Answer: ABD

   Next question

9. Question 9 · 167 in bank

   In the deployment planning process, when should a person identify who gets to see network data?

   • ADeployment schedule
   • BTopology diagramming
   • CData source inventory
   • DData policy definition

   Show answer

   Answer: D

   Next question

10. Question 10 · 167 in bank

    A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master. How much data can the customer ingest before search is locked out?

    • A300GB. After this limit, search is locked out.
    • B500GB. After this limit, search is locked out.
    • C800GB. After this limit, search is locked out.
    • DSearch is not locked out. Violations are still recorded.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-2002 practice, question 1. 167 questions available.