SPLK-2002 practice questions 111–120

1. Question 111 · 167 in bank

   A single-site indexer cluster has a replication factor of 3, and a search factor of 2. What is true about this cluster?

   • AThe cluster will ensure only two search heads are allowed to access the bucket at the same time.
   • BThe cluster will ensure there are at least three copies of each bucket, and at least two copies of searchable metadata.
   • CThe cluster will ensure there are at least two copies of each bucket, and at least three copies of searchable metadata.
   • DThe cluster will ensure there are at most three copies of each bucket, and at most two copies of searchable metadata.

   Show answer

   Answer: B

   Next question

2. Question 112 · 167 in bank

   Select 2

   Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)

   • Atelnet
   • Btcpdump
   • Csplunk btool
   • Dsplunk btprobe

   Show answer

   Answer: AB

   Next question

3. Question 113 · 167 in bank

   An admin removed and re-added search head cluster (SHC) members as part of patching the operating system. When trying to re-add the first member, a script reverted the SHC member to a previous backup, and the member refuses to join the cluster. What is the best approach to fix the member so that it can re-join?

   • AForce the member add by running splunk edit shcluster-config --force.
   • BReview splunkd.log for configuration changes preventing the addition of the member.
   • CClean the Raft metadata using splunk clean raft.
   • DDelete the [shclustering] stanza in server.conf and restart Splunk.

   Show answer

   Answer: C

   Next question

4. Question 114 · 167 in bank

   A search head has successfully joined a single site indexer cluster. Which command is used to configure the same search head to join another indexer cluster?

   • Asplunk add cluster-config
   • Bsplunk add cluster-master
   • Csplunk edit cluster-config
   • Dsplunk edit cluster-master

   Show answer

   Answer: B

   Next question

5. Question 115 · 167 in bank

   Which command permanently decommissions a peer in an indexer cluster?

   • Asplunk offline --enforce-counts
   • Bsplunk stop
   • Csplunk offline
   • Dsplunk edit cluster-config -mode disabled

   Show answer

   Answer: A

   Next question

6. Question 116 · 167 in bank

   Select 2

   To improve Splunk performance, parallelIngestionPipelines setting can be adjusted on which of the following components in the Splunk architecture? (Select all that apply.)

   • AIndexers
   • BForwarders
   • CSearch head
   • DCluster master

   Show answer

   Answer: AB

   Next question

7. Question 117 · 167 in bank

   When would a Heavy Forwarder be needed instead of a Universal Forwarder?

   • ATo use Splunk TCP to forward event data.
   • BTo route event data to an indexer cluster.
   • CTo mask event data from Linux inputs prior to forwarding to indexers.
   • DTo change event host names based on the folder structure where the input is found.

   Show answer

   Answer: C

   Next question

8. Question 118 · 167 in bank

   When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

   • A1. Delete Splunk Enterprise, if it exists. 2. Install and initialize the instance. 3. Join the SHC.
   • B1. Install and initialize the instance. 2. Delete Splunk Enterprise, if it exists. 3. Join the SHC.
   • C1. Initialize cluster rebalance operation. 2. Remove master node from cluster. 3. Trigger replication.
   • D1. Trigger replication. 2. Remove master node from cluster. 3. Initialize cluster rebalance operation.

   Show answer

   Answer: A

   Next question

9. Question 119 · 167 in bank

   When is a collected diag package in the diag server deleted by default?

   • AC After 7 days
   • BAfter 30 days
   • CNever; delete it manually.
   • DAt midnight

   Show answer

   Answer: C

   Next question

10. Question 120 · 167 in bank

    When troubleshooting monitor inputs, which command checks the status of the tailed files?

    • Asplunk cmd btool inputs list | tail
    • Bsplunk cmd btool check inputs layer
    • Ccurl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus
    • Dcurl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:Tailstatus

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-2002 practice, question 111. 167 questions available.