Splunk Splunk Certifications SPLK-2002 Questions & Answers

• Question 11:

  In a distributed environment, knowledge object bundles are replicated from the search head to which location on the search peer(s)?

  A. SPLUNK_HOME/var/lib/searchpeers

  B. SPLUNK_HOME/var/log/searchpeers

  C. SPLUNK_HOME/var/run/searchpeers

  D. SPLUNK_HOME/var/spool/searchpeers

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/Whatsearchheadssend

• Question 12:

  Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor has built one. What are the items that must be evaluated before installing the add-on? (Select all that apply.)

  A. Identify number of scheduled or real-time searches.

  B. Validate if this Technical Add-On enables event data for a data model.

  C. Identify the maximum number of forwarders Technical Add-On can support.

  D. Verify if Technical Add-On needs to be installed onto both a search head or indexer.

  Correct Answer: AC

• Question 13:

  When configuring a Splunk indexer cluster, what are the default values for replication and search factor?

  A. replication_factor = 2 search_factor = 2

  B. replication_factor = 2 search factor = 3

  C. replication_factor = 3 search_factor = 2

  D. replication_factor = 3 search factor = 3

  Correct Answer: C

• Question 14:

  As a best practice, where should the internal licensing logs be stored?

  A. Indexing layer.

  B. License server.

  C. Deployment layer.

  D. Search head layer.

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/ITSI/4.3.1/Install/Plan

• Question 15:

  How does the average run time of all searches relate to the available CPU cores on the indexers?

  A. Average run time is independent of the number of CPU cores on the indexers.

  B. Average run time decreases as the number of CPU cores on the indexers decreases.

  C. Average run time increases as the number of CPU cores on the indexers decreases.

  D. Average run time increases as the number of CPU cores on the indexers increases.

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/ Accommodatemanysimultaneoussearches

• Question 16:

  Which of the following statements about integrating with third-party systems is true? (Select all that apply.)

  A. A Hadoop application can search data in Splunk.

  B. Splunk can search data in the Hadoop File System (HDFS).

  C. You can use Splunk alerts to provision actions on a third-party system.

  D. You can forward data from Splunk forwarder to a third-party system without indexing it first.

  Correct Answer: CD

• Question 17:

  Which of the following is an indexer clustering requirement?

  A. Must use shared storage.

  B. Must reside on a dedicated rack.

  C. Must have at least three members.

  D. Must share the same license pool.

  Correct Answer: D

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Distdeploylicenses

• Question 18:

  What is the algorithm used to determine captaincy in a Splunk search head cluster?

  A. Raft distributed consensus.

  B. Rapt distributed consensus.

  C. Rift distributed consensus.

  D. Round-robin distribution consensus.

  Correct Answer: A

  Reference: https://answers.splunk.com/answers/664102/need-to-know-about-raft-directory-on-searchhead-c.html

• Question 19:

  Which of the following should be done when installing Enterprise Security on a Search Head Cluster? (Select all that apply.)

  A. Install Enterprise Security on the deployer.

  B. Install Enterprise Security on a staging instance.

  C. Copy the Enterprise Security configurations to the deployer.

  D. Use the deployer to deploy Enterprise Security to the cluster members.

  Correct Answer: AD

  Reference: https://docs.splunk.com/Documentation/ES/5.3.1/Install/InstallEnterpriseSecuritySHC

• Question 20:

  Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?

  A. System local directory.

  B. System default directory.

  C. App local directories, in ASCII order.

  D. App default directories, in ASCII order.

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Wheretofindtheconfigurationfiles