Splunk SPLK-2002 Online Practice Questions and Exam Preparation

Splunk SPLK-2002 Online Questions & Answers

• Question 61:

  Which of the following tasks should the architect perform when building a deployment plan? (Select all that apply.)

  A. Use case checklist.
  B. Install Splunk apps.
  C. Inventory data sources.
  D. Review network topology.
  D. Review network topology.

• Question 62:

  A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master. How much data can the customer ingest before search is locked out?

  A. 300GB. After this limit, search is locked out.
  B. 500GB. After this limit, search is locked out.
  C. 800GB. After this limit, search is locked out.
  D. Search is not locked out. Violations are still recorded.
  D. Search is not locked out. Violations are still recorded.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/TypesofSplunklicenses

• Question 63:

  Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor has built one. What are the items that must be evaluated before installing the add-on? (Select all that apply.)

  A. Identify number of scheduled or real-time searches.
  B. Validate if this Technical Add-On enables event data for a data model.
  C. Identify the maximum number of forwarders Technical Add-On can support.
  D. Verify if Technical Add-On needs to be installed onto both a search head or indexer.
  A. Identify number of scheduled or real-time searches.
  C. Identify the maximum number of forwarders Technical Add-On can support.

• Question 64:

  What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

  A. Distributes apps to SHC members.
  B. Bootstraps a clean Splunk install for a SHC.
  C. Distributes non-search related and manual configuration file changes.
  D. Distributes runtime knowledge object changes made by users across the SHC.
  A. Distributes apps to SHC members.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/SHCdeploymentoverview

• Question 65:

  To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

  A. adhoc_searchhead = true (on all members)
  B. adhoc_searchhead = true (on the current captain)
  C. captain_is_adhoc_searchhead = true (on all members)
  D. captain_is_adhoc_searchhead = true (on the current captain)
  D. captain_is_adhoc_searchhead = true (on the current captain)

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/Adhocclustermember

• Question 66:

  What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?

  A. btool.log
  B. metrics.log
  C. splunkd.log
  D. tailing_processor.log
  C. splunkd.log

  ---

  Reference: https://answers.splunk.com/answers/479312/how-to-edit-inputsconf-to-monitor-multiple-files-w-1.html

• Question 67:

  Which Splunk Enterprise offering has its own license?

  A. Splunk Cloud Forwarder
  B. Splunk Heavy Forwarder
  C. Splunk Universal Forwarder
  D. Splunk Forwarder Management
  C. Splunk Universal Forwarder

  ---

  Reference: https://docs.splunk.com/Splexicon:Forwardinglicense

• Question 68:

  A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk.

  How many indexers are recommended for this deployment?

  A. Two indexers not in a cluster, assuming users run many long searches.
  B. Three indexers not in a cluster, assuming a long data retention period.
  C. Two indexers clustered, assuming high availability is the greatest priority.
  D. Two indexers clustered, assuming a high volume of saved/scheduled searches.
  D. Two indexers clustered, assuming a high volume of saved/scheduled searches.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/Summaryofperformancerecommendations

• Question 69:

  Which of the following describe migration from single-site to multisite index replication?

  A. A master node is required at each site.
  B. Multisite policies apply to new data only.
  C. Single-site buckets instantly receive the multisite policies.
  D. Multisite total values should not exceed any single-site factors.
  D. Multisite total values should not exceed any single-site factors.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Migratetomultisite

• Question 70:

  Configurations from the deployer are merged into which location on the search head cluster member?

  A. SPLUNK_HOME/etc/system/local
  B. SPLUNK_HOME/etc/apps/APP_HOME/local
  C. SPLUNK_HOME/etc/apps/search/default
  D. SPLUNK_HOME/etc/apps/APP_HOME/default
  A. SPLUNK_HOME/etc/system/local

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/PropagateSHCconfigurationchanges