Splunk SPLK-2002 Online Practice Questions and Exam Preparation

Splunk SPLK-2002 Online Questions & Answers

• Question 31:

  Which search head cluster component is responsible for pushing knowledge bundles to search peers, replicating configuration changes to search head cluster members, and scheduling jobs across the search head cluster?

  A. Master
  B. Captain
  C. Deployer
  D. Deployment server
  B. Captain

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/SHCarchitecture

• Question 32:

  Which Splunk internal index contains license-related events?

  A. _audit
  B. _license
  C. _internal
  D. _introspection
  C. _internal

  ---

  Reference: https://answers.splunk.com/answers/579494/how-to-display-license-consumed-by-an-index-over-2.html

• Question 33:

  How does the average run time of all searches relate to the available CPU cores on the indexers?

  A. Average run time is independent of the number of CPU cores on the indexers.
  B. Average run time decreases as the number of CPU cores on the indexers decreases.
  C. Average run time increases as the number of CPU cores on the indexers decreases.
  D. Average run time increases as the number of CPU cores on the indexers increases.
  C. Average run time increases as the number of CPU cores on the indexers decreases.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/Accommodatemanysimultaneoussearches

• Question 34:

  Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?

  A. System local directory.
  B. System default directory.
  C. App local directories, in ASCII order.
  D. App default directories, in ASCII order.
  A. System local directory.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Wheretofindtheconfigurationfiles

• Question 35:

  What is the logical first step when starting a deployment plan?

  A. Inventory the currently deployed logging infrastructure.
  B. Determine what apps and use cases will be implemented.
  C. Gather statistics on the expected adoption of Splunk for sizing.
  D. Collect the initial requirements for the deployment from all stakeholders.
  D. Collect the initial requirements for the deployment from all stakeholders.

• Question 36:

  Which Splunk server role regulates the functioning of indexer cluster?

  A. Indexer
  B. Deployer
  C. Master Node
  D. Monitoring Console
  C. Master Node

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Deploy/Indexercluster

• Question 37:

  Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)

  A. telnet
  B. tcpdump
  C. splunk btool
  D. splunk btprobe
  B. tcpdump
  C. splunk btool

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Security/Troubleshootyouforwardertoindexerauthentication

• Question 38:

  Which CLI command converts a Splunk instance to a license slave?

  A. splunk add licenses
  B. splunk list licenser-slaves
  C. splunk edit licenser-localslave
  D. splunk list licenser-localslave
  C. splunk edit licenser-localslave

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/LicenserCLIcommands

• Question 39:

  In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files. What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?

  A. Total daily indexing volume, number of peer nodes, and number of accelerated searches.
  B. Total daily indexing volume, number of peer nodes, replication factor, and search factor.
  C. Total daily indexing volume, replication factor, search factor, and number of search heads.
  D. Replication factor, search factor, number of accelerated searches, and total disk size across cluster.
  D. Replication factor, search factor, number of accelerated searches, and total disk size across cluster.

• Question 40:

  A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?

  A. Create a job server on the cluster.
  B. Add another search head to the cluster.
  C. server.conf captain_is_adhoc_searchhead = true.
  D. Change limits.conf value for max_searches_per_cpu to a higher value.
  D. Change limits.conf value for max_searches_per_cpu to a higher value.