SPLK-2002 practice questions 161–167

1. Question 161 · 167 in bank

   Which of the following is true for a KV Store lookup, but not true for a CSV lookup?

   • AKV Store lookups support row-level RBAC.
   • BKV Store lookups can be owned by multiple users.
   • CKV Store lookups are always replicated to indexers as part of the knowledge bundle.
   • DKV Store lookups can be updated without replacing the entire lookup.

   Show answer

   Answer: D

   Next question

2. Question 162 · 167 in bank

   How many cluster managers are required for a multisite indexer cluster?

   • AOne for the entire cluster.
   • BTwo for each site.
   • CTwo for the entire cluster.
   • DOne for each site.

   Show answer

   Answer: A

   Next question

3. Question 163 · 167 in bank

   In splunkd.log events written to the _internal index, which field identifies the specific log channel?

   • Asource
   • Bchannel
   • Ccomponent
   • Dsourcetype

   Show answer

   Answer: C

   Next question

4. Question 164 · 167 in bank

   Several critical searches that were functioning correctly yesterday are not finding a lookup table today. Which log file would be the best place to start troubleshooting?

   • Aweb_access.log
   • Bbtool.log
   • Cconfiguration_change.log
   • Dhealth.log

   Show answer

   Answer: C

   Next question

5. Question 165 · 167 in bank

   A customer has a Splunk Enterprise deployment and wants to collect data from universal forwarders. What is the best step to secure log traffic?

   • ACreate signed SSL certificates and use them to encrypt data between the search heads and indexers.
   • BUse the Splunk provided SSL certificates to encrypt data between the forwarders and indexers.
   • CEnsure all forwarded traffic is routed through a web application firewall (WAF).
   • DCreate signed SSL certificates and use them to encrypt data between the forwarders and indexers.

   Show answer

   Answer: D

   Next question

6. Question 166 · 167 in bank

   A customer creates a saved search that runs on a specific interval. Which internal Splunk log should be viewed to determine if the search ran recently?

   • Akvstore.log
   • Bscheduler.log
   • Cmetrics.log
   • Dbtool.log

   Show answer

   Answer: B

   Next question

7. Question 167 · 167 in bank

   When troubleshooting a situation where some files within a directory are not being indexed, the ignored files are discovered to have long headers. What is the first thing that should be added to inputs.conf?

   • AAdd a crcSalt= attribute.
   • BIncrease the value of initCrcLength.
   • CDecrease the value of initCrcLength.
   • DAdd a crcSalt= attribute.

   Show answer

   Answer: B

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-2002 practice, question 161. 167 questions available.