Splunk Splunk Certifications SPLK-2002 Questions & Answers

• Question 41:

  In the deployment planning process, when should a person identify who gets to see network data?

  A. Deployment schedule

  B. Topology diagramming

  C. Data source inventory

  D. Data policy definition

  Correct Answer: C

• Question 42:

  The KV store forms its own cluster within a SHC. What is the maximum number of SHC members KV store will form?

  A. 25

  B. 50

  C. 100

  D. Unlimited

  Correct Answer: D

• Question 43:

  To optimize the distribution of primary buckets; when does primary rebalancing automatically occur? (Select all that apply.)

  A. Rolling restart completes.

  B. Master node rejoins the cluster.

  C. Captain joins or rejoins cluster.

  D. A peer node joins or rejoins the cluster.

  Correct Answer: ABD

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Rebalancethecluster

• Question 44:

  Which search head cluster component is responsible for pushing knowledge bundles to search peers, replicating configuration changes to search head cluster members, and scheduling jobs across the search head cluster?

  A. Master

  B. Captain

  C. Deployer

  D. Deployment server

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/SHCarchitecture

• Question 45:

  Configurations from the deployer are merged into which location on the search head cluster member?

  A. SPLUNK_HOME/etc/system/local

  B. SPLUNK_HOME/etc/apps/APP_HOME/local

  C. SPLUNK_HOME/etc/apps/search/default

  D. SPLUNK_HOME/etc/apps/APP_HOME/default

  Correct Answer: A

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/ PropagateSHCconfigurationchanges

• Question 46:

  When Splunk indexes data in a non clustered environment, what kind of files does it create by default?

  A. Index and .tsidx files.

  B. Rawdata and index files.

  C. Compressed and .tsidx files.

  D. Compressed and meta data files.

  Correct Answer: B

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Indexer/Aboutindexesandindexers

• Question 47:

  Which search will show all deployment client messages from the client (UF)?

  A. index=_audit component=DC* host= | stats count by message

  B. index=_audit component=DC* host= | stats count by message

  C. index=_internal component= DC* host= | stats count by message

  D. index=_internal component=DS* host= | stats count by message

  Correct Answer: D

  Reference: https://answers.splunk.com/answers/461939/after-all-clients-are-registered-to-a-deployments.html

• Question 48:

  Which Splunk internal index contains license-related events?

  A. _audit

  B. _license

  C. _internal

  D. _introspection

  Correct Answer: C

  Reference: https://answers.splunk.com/answers/579494/how-to-display-license-consumed-by-an-indexover-2.html

• Question 49:

  Which of the following statements describe a Search Head Cluster (SHC) captain? (Select all that apply.)

  A. Is the job scheduler for the entire SHC.

  B. Manages alert action suppressions (throttling).

  C. Synchronizes the member list with the KV store primary.

  D. Replicates the SHC's knowledge bundle to the search peers.

  Correct Answer: AD

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/ SHCarchitecture#role_of_the_captain

• Question 50:

  Before users can use a KV store, an admin must create a collection. Where is a collection is defined?

  A. kvstore.conf

  B. collection.conf

  C. collections.conf

  D. kvcollections.conf

  Correct Answer: C

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Knowledge/ DefineaKVStorelookupinSplunkWeb