Splunk SPLK-2002 Online Practice Questions and Exam Preparation

Splunk SPLK-2002 Online Questions & Answers

• Question 1:

  When planning a search head cluster, which of the following is true?

  A. All search heads must use the same operating system.
  B. All search heads must be members of the cluster (no standalone search heads).
  C. The search head captain must be assigned to the largest search head in the cluster.
  D. All indexers must belong to the underlying indexer cluster (no standalone indexers).
  C. The search head captain must be assigned to the largest search head in the cluster.

• Question 2:

  Which command will permanently decommission a peer node operating in an indexer cluster?

  A. splunk stop -f
  B. splunk offline -f
  C. splunk offline --enforce-counts
  D. splunk decommission --enforce counts
  C. splunk offline --enforce-counts

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Takeapeeroffline

• Question 3:

  A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?

  A. Configure syslog to send the data to multiple Splunk indexers.
  B. Use a Splunk indexer to collect a network input on port 514 directly.
  C. Use a Splunk forwarder to collect the input on port 514 and forward the data.
  D. Configure syslog to write logs and use a Splunk forwarder to collect the logs.
  C. Use a Splunk forwarder to collect the input on port 514 and forward the data.

  ---

  Reference: https://wiki.splunk.com/Community:BestPracticeForConfiguringSyslogInput

• Question 4:

  When adding or rejoining a member to a search head cluster, the following error is displayed:

  Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member.

  What corrective action should be taken?

  A. Restart the search head.
  B. Run the splunk apply shcluster-bundle command from the deployer.
  C. Run the clean raft command on all members of the search head cluster.
  D. Run the splunk resync shcluster-replicated-config command on this member.
  B. Run the splunk apply shcluster-bundle command from the deployer.

• Question 5:

  Which of the following are true statements about Splunk indexer clustering?

  A. All peer nodes must run exactly the same Splunk version.
  B. The master node must run the same or a later Splunk version than search heads.
  C. The peer nodes must run the same or a later Splunk version than the master node.
  D. The search head must run the same or a later Splunk version than the peer nodes.
  B. The master node must run the same or a later Splunk version than search heads.

  ---

  Reference: https://answers.splunk.com/answers/760348/search-head-version-compatibility.html

• Question 6:

  Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

  A. Increasing the search factor in the cluster.
  B. Increasing the replication factor in the cluster.
  C. Increasing the number of search heads in the cluster.
  D. Increasing the number of CPUs on the indexers in the cluster.
  B. Increasing the replication factor in the cluster.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/SHCarchitecture

• Question 7:

  When troubleshooting monitor inputs, which command checks the status of the tailed files?

  A. splunk cmd btool inputs list | tail
  B. splunk cmd btool check inputs layer
  C. curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus
  D. curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:Tailstatus
  C. curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Troubleshoottheinputprocess#Troubleshoot_your_tailed_files

• Question 8:

  Which of the following commands is used to clear the KV store?

  A. splunk clean kvstore
  B. splunk clear kvstore
  C. splunk delete kvstore
  D. splunk reinitialize kvstore
  A. splunk clean kvstore

  ---

  Reference: https://answers.splunk.com/answers/237859/can-i-delete-all-data-from-a-kv-store-at-once.html

• Question 9:

  What is the default log size for Splunk internal logs?

  A. 10MB
  B. 20 MB
  C. 25MB D. 30MB
  C. 25MB D. 30MB

  ---

  Reference: https://answers.splunk.com/answers/959/how-can-i-control-the-size-and-number-of-splunks-internal-logs.html

• Question 10:

  Which of the following options can improve reliability of syslog delivery to Splunk? (Select all that apply.)

  A. Use TCP syslog.
  B. Configure UDP inputs on each Splunk indexer to receive data directly.
  C. Use a network load balancer to direct syslog traffic to active backend syslog listeners.
  D. Use one or more syslog servers to persist data with a Universal Forwarder to send the data to Splunk indexers.
  C. Use a network load balancer to direct syslog traffic to active backend syslog listeners.
  D. Use one or more syslog servers to persist data with a Universal Forwarder to send the data to Splunk indexers.