Splunk SPLK-2002 Online Practice Questions and Exam Preparation

Splunk SPLK-2002 Online Questions & Answers

• Question 71:

  When configuring a Splunk indexer cluster, what are the default values for replication and search factor?

  A. replication_factor = 2 search_factor = 2
  B. replication_factor = 2 search factor = 3
  C. replication_factor = 3 search_factor = 2
  D. replication_factor = 3 search factor = 3
  C. replication_factor = 3 search_factor = 2

• Question 72:

  A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining that the events are inconsistently formatted for a web sourcetype. Further investigation reveals that not all web logs flow through the

  same infrastructure: some of the data goes through heavy forwarders and some of the forwarders are managed by another department.

  Which of the following items might be the cause for this issue?

  A. The search head may have different configurations than the indexers.
  B. The data inputs are not properly configured across all the forwarders.
  C. The indexers may have different configurations than the heavy forwarders.
  D. The forwarders managed by the other department are an older version than the rest.
  D. The forwarders managed by the other department are an older version than the rest.

• Question 73:

  Which of the following is a best practice to maximize indexing performance?

  A. Use automatic sourcetyping.
  B. Use the Splunk default settings.
  C. Not use pre-trained source types.
  D. Minimize configuration generality.
  D. Minimize configuration generality.

• Question 74:

  In which phase of the Splunk Enterprise data pipeline are indexed extraction configurations processed?

  A. Input
  B. Search
  C. Parsing
  D. Indexing
  C. Parsing

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Configurationparametersandthedatapipeline

• Question 75:

  As a best practice, where should the internal licensing logs be stored?

  A. Indexing layer.
  B. License server.
  C. Deployment layer.
  D. Search head layer.
  D. Search head layer.

  ---

  Reference: https://docs.splunk.com/Documentation/ITSI/4.3.1/Install/Plan

• Question 76:

  Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index. Which of the following logs are included in this index? (Select all that apply.)

  A. audit.log
  B. metrics.log
  C. disk_objects.log
  D. resource_usage.log
  C. disk_objects.log
  D. resource_usage.log

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Troubleshooting/Abouttheplatforminstrumentationframework

• Question 77:

  In the deployment planning process, when should a person identify who gets to see network data?

  A. Deployment schedule
  B. Topology diagramming
  C. Data source inventory
  D. Data policy definition
  C. Data source inventory

• Question 78:

  Which Splunk tool offers a health check for administrators to evaluate the health of their Splunk deployment?

  A. btool
  B. DiagGen
  C. SPL Clinic
  D. Monitoring Console
  D. Monitoring Console

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DMC/DMCoverview

• Question 79:

  Which component in the splunkd.log will log information related to bad event breaking?

  A. Audittrail
  B. EventBreaking
  C. IndexingPipeline
  D. AggregatorMiningProcessor
  D. AggregatorMiningProcessor

  ---

  Reference: https://answers.splunk.com/answers/141721/error-in-splunkd-log-breaking-event-because-limit-of-256-has-been-exceeded.html

• Question 80:

  Which of the following are client filters available in serverclass.conf? (Select all that apply.)

  A. DNS name.
  B. IP address.
  C. Splunk server role.
  D. Platform (machine type).
  A. DNS name.
  B. IP address.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Updating/Filterclients#Define_filters_through_serverclass.conf