SPLK-2002 practice questions 51–60

1. Question 51 · 167 in bank

   Select 3

   In an indexer cluster, what tasks does the cluster manager perform? (Choose all that apply.)

   • AEnsures all peer nodes are always using the same version of Splunk.
   • BDistributes app bundles to peer nodes.
   • CGenerates and maintains the list of primary searchable buckets.
   • DIf Indexer Discovery is enabled, provides the list of available peer nodes to forwarders.

   Show answer

   Answer: BCD

   Next question

2. Question 52 · 167 in bank

   What are the minimum supported requirements to run a search head cluster (SHC)?

   • ATwo search heads and a deployment server.
   • BThree search heads and a deployer.
   • CTwo search heads and a deployer.
   • DThree search heads, a deployer, and a deployment server.

   Show answer

   Answer: B

   Next question

3. Question 53 · 167 in bank

   Select 2

   Which of the following artifacts are included in a Splunk diag file? (Select all that apply.)

   • AOS settings.
   • BInternal logs.
   • CCustomer data.
   • DConfiguration files.

   Show answer

   Answer: AB

   Next question

4. Question 54 · 167 in bank

   Select 2

   A high volume source and a low volume source feed into the same index. Which of the following items best describe the impact of this design choice? (Choose all that apply.)

   • AHigh volume data is optimized by the presence of low volume data.
   • BLow volume data will improve the compression factor of the high volume data.
   • CSearch speed on low volume data will be slower than necessary.
   • DLow volume data may move out of the index based on volume rather than age.

   Show answer

   Answer: CD

   Next question

5. Question 55 · 167 in bank

   Which command will permanently decommission a peer node operating in an indexer cluster?

   • Asplunk stop -f
   • Bsplunk offline -f
   • Csplunk offline --enforce-counts
   • Dsplunk decommission --enforce counts

   Show answer

   Answer: C

   Next question

6. Question 56 · 167 in bank

   Which of the following is a valid use case that a search head cluster addresses?

   • AProvide redundancy in the event a search peer fails.
   • BIncreased Search Factor (SF).
   • CKnowledge Object replication.
   • DSearch affinity.

   Show answer

   Answer: C

   Next question

7. Question 57 · 167 in bank

   Which CLI command converts a Splunk instance to a license slave?

   • Asplunk add licenses
   • Bsplunk list licenser-slaves
   • Csplunk edit licenser-localslave
   • Dsplunk list licenser-localslave

   Show answer

   Answer: C

   Next question

8. Question 58 · 167 in bank

   A customer has scoped their environment: • Data ingest of 600 GB / day • 1 standalone search head • 3 clustered indexers They have purchased an ingest license for 900 GB / day. What is the simplest way to configure their license using Splunk best practices?

   • AAdd the license and configure three pools with a custom pool size of 200 GB each.
   • BAdd the license and configure three pools with a custom pool size of 300 GB each.
   • CAdd the license and configure a single pool with a custom pool size of 200 GB.
   • DAdd the license and use the default pool size of 900 GB.

   Show answer

   Answer: D

   Next question

9. Question 59 · 167 in bank

   Select 2

   Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index. Which of the following logs are included in this index? (Select all that apply.)

   • Aaudit.log
   • Bmetrics.log
   • Cdisk_objects.log
   • Dresource_usage.log

   Show answer

   Answer: CD

   Next question

10. Question 60 · 167 in bank

    What is this search trying to determine? index=_internal sourcetype=splunkd ("pipelines finished" OR "My GUID") | transaction startswith="My GUID" endswith="pipelines finished" keepevicted=true keeporphans=true | search closed_txn=0

    • Asplunkd crash.
    • BFailed user logon.
    • CTotal indexing volume.
    • DMissing input source.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SPLK-2002 practice, question 51. 167 questions available.