Splunk SPLK-2002 Online Practice Questions and Exam Preparation

Splunk SPLK-2002 Online Questions & Answers

• Question 51:

  To optimize the distribution of primary buckets; when does primary rebalancing automatically occur? (Select all that apply.)

  A. Rolling restart completes.
  B. Master node rejoins the cluster.
  C. Captain joins or rejoins cluster.
  D. A peer node joins or rejoins the cluster.
  A. Rolling restart completes.
  B. Master node rejoins the cluster.
  D. A peer node joins or rejoins the cluster.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Rebalancethecluster

• Question 52:

  The KV store forms its own cluster within a SHC. What is the maximum number of SHC members KV store will form?

  A. 25
  B. 50
  C. 100
  D. Unlimited
  D. Unlimited

• Question 53:

  Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

  A. High performance SAN should never be used.
  B. Enable NFS for storing hot and warm buckets.
  C. The recommended RAID setup is RAID 10 (1 + 0).
  D. Virtualized environments are usually preferred over bare metal for Splunk indexers.
  C. The recommended RAID setup is RAID 10 (1 + 0).

  ---

  Reference: https://www.splunk.com/pdfs/technical-briefs/splunk-deploying-vmware-tech-brief.pdf

• Question 54:

  Which of the following should be done when installing Enterprise Security on a Search Head Cluster? (Select all that apply.)

  A. Install Enterprise Security on the deployer.
  B. Install Enterprise Security on a staging instance.
  C. Copy the Enterprise Security configurations to the deployer.
  D. Use the deployer to deploy Enterprise Security to the cluster members.
  A. Install Enterprise Security on the deployer.
  D. Use the deployer to deploy Enterprise Security to the cluster members.

  ---

  Reference: https://docs.splunk.com/Documentation/ES/5.3.1/Install/InstallEnterpriseSecuritySHC

• Question 55:

  Which of the following artifacts are included in a Splunk diag file? (Select all that apply.)

  A. OS settings.
  B. Internal logs.
  C. Customer data.
  D. Configuration files.
  B. Internal logs.
  D. Configuration files.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Troubleshooting/Generateadiag

• Question 56:

  The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. How does this divide between files in the index?

  A. rawdata is: 10%, tsidx is: 40%
  B. rawdata is: 15%, tsidx is: 35%
  C. rawdata is: 35%, tsidx is: 15%
  D. rawdata is: 40%, tsidx is: 10%
  B. rawdata is: 15%, tsidx is: 35%

  ---

  Reference: https://answers.splunk.com/answers/147951/what-is-the-compression-ratio-of-raw-data-in-splunk.html

• Question 57:

  Before users can use a KV store, an admin must create a collection. Where is a collection is defined?

  A. kvstore.conf
  B. collection.conf
  C. collections.conf
  D. kvcollections.conf
  C. collections.conf

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Knowledge/DefineaKVStorelookupinSplunkWeb

• Question 58:

  Which of the following clarification steps should be taken if apps are not appearing on a deployment client? (Select all that apply.)

  A. Check serverclass.conf of the deployment server.
  B. Check deploymentclient.conf of the deployment client.
  C. Check the content of SPLUNK_HOME/etc/apps of the deployment server.
  D. Search for relevant events in splunkd.log of the deployment server.
  A. Check serverclass.conf of the deployment server.
  B. Check deploymentclient.conf of the deployment client.
  C. Check the content of SPLUNK_HOME/etc/apps of the deployment server.

  ---

  Reference: https://answers.splunk.com/answers/177021/why-is-deployment-client-not-picking-up-changes-to.html

• Question 59:

  Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?

  A. Data encryption between Splunk Web and splunkd.
  B. Certificate authentication between forwarders and indexers.
  C. Certificate authentication between Splunk Web and search head.
  D. Data encryption for distributed search between search heads and indexers.
  B. Certificate authentication between forwarders and indexers.

• Question 60:

  What is a Splunk Job? (Select all that apply.)

  A. A user-defined Splunk capability.
  B. Searches that are subjected to some usage quota.
  C. A search process kicked off via a report or an alert.
  D. A child OS process manifested from the splunkd process.
  A. A user-defined Splunk capability.