SPLK-2002 practice questions 121–130

1. Question 121 · 167 in bank

   If .delta replication fails during knowledge bundle replication, what is the fall-back method for Splunk?

   • ARestart splunkd.
   • B.delta replication.
   • CRestart mongod.
   • D.bundle replication.

   Show answer

   Answer: D

   Next question

2. Question 122 · 167 in bank

   When should multiple search pipelines be enabled?

   • AOnly if disk IOPS is at 800 or better.
   • BOnly if there are fewer than twelve concurrent users.
   • COnly if running Splunk Enterprise version 6.6 or later.
   • DOnly if CPU and memory resources are significantly under-utilized.

   Show answer

   Answer: D

   Next question

3. Question 123 · 167 in bank

   When should a Universal Forwarder be used instead of a Heavy Forwarder?

   • AWhen most of the data requires masking.
   • BWhen data comes directly from a database server.
   • CWhen there is a high-velocity data source.
   • DWhen a modular input is needed.

   Show answer

   Answer: C

   Next question

4. Question 124 · 167 in bank

   Of the following types of files within an index bucket, which file type may consume the most disk?

   • ARawdata
   • BBloom filter
   • CMetadata (.data)
   • DInverted index (.tsidx)

   Show answer

   Answer: D

   Next question

5. Question 125 · 167 in bank

   Where can files be placed in a configuration bundle on a search peer that will persist after a new configuration bundle has been deployed?

   • ANowhere; the entire configuration bundle is overwritten with each push.
   • BIn the SSPLUNK_HOME/etc/slave-apps/_cluster/local folder.
   • CIn the SSPLUNK_HOME/etc/master-apps//local folder.
   • DIn the SSPLUNK_HOME/etc/slave-apps//local folder.

   Show answer

   Answer: A

   Next question

6. Question 126 · 167 in bank

   When converting from a single-site to a multi-site cluster, what happens to existing single-site clustered buckets?

   • AThey will continue to replicate within the origin site and age out based on existing policies.
   • BThey will maintain replication as required according to the single-site policies, but never age out.
   • CThey will be replicated across all peers in the multi-site cluster and age out based on existing policies.
   • DThey will stop replicating within the single-site and remain on the indexer they reside on and age out according to existing policies.

   Show answer

   Answer: A

   Next question

7. Question 127 · 167 in bank

   As of Splunk 9.0, which index records changes to .conf files?

   • A_audit
   • B_internal
   • C_configtracker
   • D_introspection

   Show answer

   Answer: C

   Next question

8. Question 128 · 167 in bank

   Select 2

   Which of the following should be done when installing Enterprise Security on a Search Head Cluster? (Select all that apply.)

   • AInstall Enterprise Security on the deployer.
   • BInstall Enterprise Security on a staging instance.
   • CCopy the Enterprise Security configurations to the deployer.
   • DUse the deployer to deploy Enterprise Security to the cluster members.

   Show answer

   Answer: AD

   Next question

9. Question 129 · 167 in bank

   Which of the following server.conf stanzas indicates the Indexer Discovery feature has not been fully configured (restart pending) on the Master Node?

   • A[clustering] mode = forwarder pass4SymmKey = $7$PU9SBXww63Vz3UJdDYGIN0UrdscRh83ssC2pEpwE6P3gn50iNFO94g==
   • B[clustering] mode = master pass4SymmKey = $7$tYTXzke+1r+3DULTHHDUTmYOXdtZJPxm21XwMARrJE20jsmicp9C3ni0
   • C[indexer_discovery] pass4SymmKey = idxdiscovery
   • D[indexer_discovery] pass4SymmKey = $7$XcXl1lu4950Jbui14oVe851+mvx6gCKKv6kf2zEaVB6Ie4DcZ657nLVlfW

   Show answer

   Answer: C

   Next question

10. Question 130 · 167 in bank

    Which of the following is an indexer clustering requirement?

    • AMust use shared storage.
    • BMust reside on a dedicated rack.
    • CMust have at least three members.
    • DMust share the same license pool.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-2002 practice, question 121. 167 questions available.