SPLK-2002 practice questions 151–160

1. Question 151 · 167 in bank

   By default, what does metrics.log report?

   • ATotal results of source type parsing.
   • BInspection information taken every 60 seconds.
   • CTop ten results of source type parsing.
   • DInspection information taken every 30 seconds.

   Show answer

   Answer: D

   Next question

2. Question 152 · 167 in bank

   Select 2

   Which of the following options can improve reliability of syslog delivery to Splunk? (Select all that apply.)

   • AUse TCP syslog.
   • BConfigure UDP inputs on each Splunk indexer to receive data directly.
   • CUse a network load balancer to direct syslog traffic to active backend syslog listeners.
   • DUse one or more syslog servers to persist data with a Universal Forwarder to send the data to Splunk indexers.

   Show answer

   Answer: AD

   Next question

3. Question 153 · 167 in bank

   When using ingest-based licensing, what Splunk role requires the license manager to scale?

   • ASearch heads
   • BDeployment clients
   • CSearch peers
   • DThere are no roles that require the license manager to scale

   Show answer

   Answer: C

   Next question

4. Question 154 · 167 in bank

   What is the logical first step when starting a deployment plan?

   • AInventory the currently deployed logging infrastructure.
   • BDetermine what apps and use cases will be implemented.
   • CGather statistics on the expected adoption of Splunk for sizing.
   • DCollect the initial requirements for the deployment from all stakeholders.

   Show answer

   Answer: D

   Next question

5. Question 155 · 167 in bank

   Which of the following tasks should the architect perform when building a deployment plan? (Select all that apply.)

   • AUse case checklist.
   • BInstall Splunk apps.
   • CInventory data sources.
   • DReview network topology.

   Show answer

   Answer: C

   Next question

6. Question 156 · 167 in bank

   A customer has a four site indexer cluster. The customer has requirements to store five copies of searchable data, with one searchable copy of data at the origin site, and one searchable copy at the disaster recovery site (site4). Which configuration meets these requirements?

   • Asite_replication_factor = origin:1, site4:1, total:5
   • Bsite_search_factor = origin:2, site4:1, total:3
   • Csite_search_factor = origin:1, site4:1, total:5
   • Dsite_replication_factor = origin:2, site4:1, total:3

   Show answer

   Answer: C

   Next question

7. Question 157 · 167 in bank

   What is the best way to configure and manage receiving ports for clustered indexers?

   • AUse Splunk Web to create the receiving port on each peer node.
   • BRun the splunk enable listen command on each peer node.
   • CDefine the receiving port in /etc/manager-apps/_cluster/local/inputs.conf and push it to the peer nodes.
   • DDefine the receiving port in /etc/deployment-apps/cluster-app/local/inputs.conf and deploy it to the peer nodes.

   Show answer

   Answer: C

   Next question

8. Question 158 · 167 in bank

   A Splunk instance has crashed, but no crash log was generated. There is an attempt to determine what user activity caused the crash by running the following search: index=_internal sourcetype=splunkd ("pipelines finished" OR "My GUID") | transaction startswith="My GUID" endswith="pipelines finished" keepevicted=true keeporphans=true | search closed_txn=0 | head 1 What does searching for closed_txn=0 do in this search?

   • AFilters results to situations where Splunk was started and stopped once.
   • BFilters results to situations where Splunk was stopped and then immediately restarted.
   • CFilters results to situations where Splunk was started, but not stopped.
   • DFilters results to situations where Splunk was started and stopped multiple times.

   Show answer

   Answer: C

   Next question

9. Question 159 · 167 in bank

   Which deployer push mode should be used when pushing built-in apps?

   • Adefault_only
   • Bfull
   • Cmerge_to_default
   • Dlocal_only

   Show answer

   Answer: D

   Next question

10. Question 160 · 167 in bank

    Which command is used to initially add a search head to a single-site indexer cluster?

    • Asplunk edit cluster-config -mode peer -manager_uri https://10.0.0.1:8089 -secret changeme
    • Bsplunk edit cluster-config -mode searchhead -manager_uri https://10.0.0.1:8089 -secret changeme
    • Csplunk add cluster-master -manager_uri https://10.0.0.1:8089 -secret changeme
    • Dsplunk add cluster-manager -mode searchhead -manager_uri https://10.0.0.1:8089 -secret changeme

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-2002 practice, question 151. 167 questions available.