Splunk SPLK-2002 Online Practice Questions and Exam Preparation

Splunk SPLK-2002 Online Questions & Answers

• Question 81:

  Which of the following is a good practice for a search head cluster deployer?

  A. The deployer only distributes configurations to search head cluster members when they "phone home".
  B. The deployer must be used to distribute non-replicable configurations to search head cluster members.
  C. The deployer must distribute configurations to search head cluster members to be valid configurations.
  D. The deployer only distributes configurations to search head cluster members with splunk apply shcluster-bundle.
  A. The deployer only distributes configurations to search head cluster members when they "phone home".

• Question 82:

  A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

  A. Via Splunk Web.
  B. Directly edit SPLUNK_HOME/etc/system/local/server.conf
  C. Run a splunk edit cluster-config command from the CLI.
  D. Directly edit SPLUNK_HOME/etc/system/default/server.conf
  A. Via Splunk Web.
  B. Directly edit SPLUNK_HOME/etc/system/local/server.conf

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Enableclustersindetail

• Question 83:

  Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

  A. REPORT
  B. LINE_BREAKER
  C. ANNOTATE_PUNCT
  D. SHOULD_LINEMERGE
  B. LINE_BREAKER
  D. SHOULD_LINEMERGE

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Data/Configureeventlinebreaking

• Question 84:

  Of the following types of files within an index bucket, which file type may consume the most disk?

  A. Rawdata
  B. Bloom filter
  C. Metadata (.data)
  D. Inverted index (.tsidx)
  B. Bloom filter

• Question 85:

  Which of the following statements about integrating with third-party systems is true? (Select all that apply.)

  A. A Hadoop application can search data in Splunk.
  B. Splunk can search data in the Hadoop File System (HDFS).
  C. You can use Splunk alerts to provision actions on a third-party system.
  D. You can forward data from Splunk forwarder to a third-party system without indexing it first.
  C. You can use Splunk alerts to provision actions on a third-party system.
  D. You can forward data from Splunk forwarder to a third-party system without indexing it first.

• Question 86:

  The frequency in which a deployment client contacts the deployment server is controlled by what?

  A. polling_interval attribute in outputs.conf
  B. phoneHomeIntervalInSecs attribute in outputs.conf
  C. polling_interval attribute in deploymentclient.conf
  D. phoneHomeIntervalInSecs attribute in deploymentclient.conf
  D. phoneHomeIntervalInSecs attribute in deploymentclient.conf

  ---

  Reference: https://docs.splunk.com/Documentation/SplunkCloud/7.2.7/RESTREF/RESTdeploy

• Question 87:

  Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?

  A. Setting the cluster search factor to N-1.
  B. Increasing the number of buckets per index.
  C. Decreasing the data model acceleration range.
  D. Setting the cluster replication factor to N-1.
  D. Setting the cluster replication factor to N-1.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Systemrequirements

• Question 88:

  When Splunk is installed, where are the internal indexes stored by default?

  A. SPLUNK_HOME/bin
  B. SPLUNK_HOME/var/lib
  C. SPLUNK_HOME/var/run
  D. SPLUNK_HOME/etc/system/default
  B. SPLUNK_HOME/var/lib

  ---

  Reference: https://answers.splunk.com/answers/3806/where-does-splunk-store-the-logs.html

• Question 89:

  What is the algorithm used to determine captaincy in a Splunk search head cluster?

  A. Raft distributed consensus.
  B. Rapt distributed consensus.
  C. Rift distributed consensus.
  D. Round-robin distribution consensus.
  A. Raft distributed consensus.

  ---

  Reference: https://answers.splunk.com/answers/664102/need-to-know-about-raft-directory-on-search-head-c.html

• Question 90:

  Which of the following is an indexer clustering requirement?

  A. Must use shared storage.
  B. Must reside on a dedicated rack.
  C. Must have at least three members.
  D. Must share the same license pool.
  D. Must share the same license pool.

  ---

  Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Distdeploylicenses