March Sale - Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: dpm65

SPLK-2002 Splunk Enterprise Certified Architect Questions and Answers

Questions 4

Which of the following options can improve reliability of syslog delivery to Splunk? (Select all that apply.)

Options:

A.

Use TCP syslog.

B.

Configure UDP inputs on each Splunk indexer to receive data directly.

C.

Use a network load balancer to direct syslog traffic to active backend syslog listeners.

D.

Use one or more syslog servers to persist data with a Universal Forwarder to send the data to Splunk indexers.

Buy Now
Questions 5

Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

Options:

A.

Increasing the search factor in the cluster.

B.

Increasing the replication factor in the cluster.

C.

Increasing the number of search heads in the cluster.

D.

Increasing the number of CPUs on the indexers in the cluster.

Buy Now
Questions 6

When designing the number and size of indexes, which of the following considerations should be applied?

Options:

A.

Expected daily ingest volume, access controls, number of concurrent users

B.

Number of installed apps, expected daily ingest volume, data retention time policies

C.

Data retention time policies, number of installed apps, access controls

D.

Expected daily ingest volumes, data retention time policies, access controls

Buy Now
Questions 7

When implementing KV Store Collections in a search head cluster, which of the following considerations is true?

Options:

A.

The KV Store Primary coordinates with the search head cluster captain when collection content changes.

B.

The search head cluster captain is also the KV Store Primary when collection content changes.

C.

The KV Store Collection will not allow for changes to content if there are more than 50 search heads in the cluster.

D.

Each search head in the cluster independently updates its KV store collection when collection content changes.

Buy Now
Questions 8

How does the average run time of all searches relate to the available CPU cores on the indexers?

Options:

A.

Average run time is independent of the number of CPU cores on the indexers.

B.

Average run time decreases as the number of CPU cores on the indexers decreases.

C.

Average run time increases as the number of CPU cores on the indexers decreases.

D.

Average run time increases as the number of CPU cores on the indexers increases.

Buy Now
Questions 9

Which of the following server. conf stanzas indicates the Indexer Discovery feature has not been fully configured (restart pending) on the Master Node?

A)

SPLK-2002 Question 9

B)

SPLK-2002 Question 9

C)

SPLK-2002 Question 9

D)

SPLK-2002 Question 9

Options:

A.

Option A

B.

Option B

C.

Option C

D.

Option D

Buy Now
Questions 10

How can internal logging levels in a Splunk environment be changed to troubleshoot an issue? (select all that apply)

Options:

A.

Use the Monitoring Console (MC).

B.

Use Splunk command line.

C.

Use Splunk Web.

D.

Edit log-local. cfg.

Buy Now
Questions 11

The KV store forms its own cluster within a SHC. What is the maximum number of SHC members KV store will form?

Options:

A.

25

B.

50

C.

100

D.

Unlimited

Buy Now
Questions 12

Which of the following should be included in a deployment plan?

Options:

A.

Business continuity and disaster recovery plans.

B.

Current logging details and data source inventory.

C.

Current and future topology diagrams of the IT environment.

D.

A comprehensive list of stakeholders, either direct or indirect.

Buy Now
Questions 13

Which of the following is a valid use case that a search head cluster addresses?

Options:

A.

Provide redundancy in the event a search peer fails.

B.

Search affinity.

C.

Knowledge Object replication.

D.

Increased Search Factor (SF).

Buy Now
Questions 14

Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?

Options:

A.

System local directory.

B.

System default directory.

C.

App local directories, in ASCII order.

D.

App default directories, in ASCII order.

Buy Now
Questions 15

In a distributed environment, knowledge object bundles are replicated from the search head to which location on the search peer(s)?

Options:

A.

SPLUNK_HOME/var/lib/searchpeers

B.

SPLUNK_HOME/var/log/searchpeers

C.

SPLUNK_HOME/var/run/searchpeers

D.

SPLUNK_HOME/var/spool/searchpeers

Buy Now
Questions 16

At which default interval does metrics.log generate a periodic report regarding license utilization?

Options:

A.

10 seconds

B.

30 seconds

C.

60 seconds

D.

300 seconds

Buy Now
Questions 17

Which of the following tasks should the architect perform when building a deployment plan? (Select all that apply.)

Options:

A.

Use case checklist.

B.

Install Splunk apps.

C.

Inventory data sources.

D.

Review network topology.

Buy Now
Questions 18

Which Splunk server role regulates the functioning of indexer cluster?

Options:

A.

Indexer

B.

Deployer

C.

Master Node

D.

Monitoring Console

Buy Now
Questions 19

Which of the following is a good practice for a search head cluster deployer?

Options:

A.

The deployer only distributes configurations to search head cluster members when they “phone home”.

B.

The deployer must be used to distribute non-replicable configurations to search head cluster members.

C.

The deployer must distribute configurations to search head cluster members to be valid configurations.

D.

The deployer only distributes configurations to search head cluster members with splunk apply shcluster-bundle.

Buy Now
Questions 20

If there is a deployment server with many clients and one deployment client is not updating apps, which of the following should be done first?

Options:

A.

Choose a longer phone home interval for all of the deployment clients.

B.

Increase the number of CPU cores for the deployment server.

C.

Choose a corrective action based on the splunkd. log of the deployment client.

D.

Increase the amount of memory for the deployment server.

Buy Now
Questions 21

To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?

Options:

A.

repFactor = 0

B.

replicate = 0

C.

repFactor = auto

D.

replicate = auto

Buy Now
Questions 22

What is the minimum reference server specification for a Splunk indexer?

Options:

A.

12 CPU cores, 12GB RAM, 800 IOPS

B.

16 CPU cores, 16GB RAM, 800 IOPS

C.

24 CPU cores, 16GB RAM, 1200 IOPS

D.

28 CPU cores, 32GB RAM, 1200 IOPS

Buy Now
Questions 23

Which props.conf setting has the least impact on indexing performance?

Options:

A.

SHOULD_LINEMERGE

B.

TRUNCATE

C.

CHARSET

D.

TIME_PREFIX

Buy Now
Questions 24

When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

Options:

A.

1. Delete Splunk Enterprise, if it exists.2. Install and initialize the instance.3. Join the SHC.

B.

1. Install and initialize the instance.2. Delete Splunk Enterprise, if it exists.3. Join the SHC.

C.

1. Initialize cluster rebalance operation.2. Remove master node from cluster.3. Trigger replication.

D.

1. Trigger replication.2. Remove master node from cluster.3. Initialize cluster rebalance operation.

Buy Now
Questions 25

As a best practice, where should the internal licensing logs be stored?

Options:

A.

Indexing layer.

B.

License server.

C.

Deployment layer.

D.

Search head layer.

Buy Now
Questions 26

When preparing to ingest a new data source, which of the following is optional in the data source assessment?

Options:

A.

Data format

B.

Data location

C.

Data volume

D.

Data retention

Buy Now
Questions 27

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

Options:

A.

Two indexers not in a cluster, assuming users run many long searches.

B.

Three indexers not in a cluster, assuming a long data retention period.

C.

Two indexers clustered, assuming high availability is the greatest priority.

D.

Two indexers clustered, assuming a high volume of saved/scheduled searches.

Buy Now
Questions 28

An index has large text log entries with many unique terms in the raw data. Other than the raw data, which index components will take the most space?

Options:

A.

Index files (*. tsidx files).

B.

Bloom filters (bloomfilter files).

C.

Index source metadata (sources.data files).

D.

Index sourcetype metadata (SourceTypes. data files).

Buy Now
Questions 29

Which of the following use cases would be made possible by multi-site clustering? (select all that apply)

Options:

A.

Use blockchain technology to audit search activity from geographically dispersed data centers.

B.

Enable a forwarder to send data to multiple indexers.

C.

Greatly reduce WAN traffic by preferentially searching assigned site (search affinity).

D.

Seamlessly route searches to a redundant site in case of a site failure.

Buy Now
Questions 30

Which search will show all deployment client messages from the client (UF)?

Options:

A.

index=_audit component=DC* host= | stats count by message

B.

index=_audit component=DC* host= | stats count by message

C.

index=_internal component= DC* host= | stats count by message

D.

index=_internal component=DS* host= | stats count by message

Buy Now
Questions 31

Which of the following are possible causes of a crash in Splunk? (select all that apply)

Options:

A.

Incorrect ulimit settings.

B.

Insufficient disk IOPS.

C.

Insufficient memory.

D.

Running out of disk space.

Buy Now
Questions 32

Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search performance improvement?

Options:

A.

Replace the indexer storage to solid state drives (SSD).

B.

Add more search heads and redistribute users based on the search type.

C.

Look for slow searches and reschedule them to run during an off-peak time.

D.

Add more search peers and make sure forwarders distribute data evenly across all indexers.

Buy Now
Questions 33

Users are asking the Splunk administrator to thaw recently-frozen buckets very frequently. What could the Splunk administrator do to reduce the need to thaw buckets?

Options:

A.

Change f rozenTimePeriodlnSecs to a larger value.

B.

Change maxTotalDataSizeMB to a smaller value.

C.

Change maxHotSpanSecs to a larger value.

D.

Change coldToFrozenDir to a different location.

Buy Now
Questions 34

A customer currently has many deployment clients being managed by a single, dedicated deployment server. The customer plans to double the number of clients.

What could be done to minimize performance issues?

Options:

A.

Modify deploymentclient. conf to change from a Pull to Push mechanism.

B.

Reduce the number of apps in the Manager Node repository.

C.

Increase the current deployment client phone home interval.

D.

Decrease the current deployment client phone home interval.

Buy Now
Questions 35

Which of the following Splunk deployments has the recommended minimum components for a high-availability search head cluster?

Options:

A.

2 search heads, 1 deployer, 2 indexers

B.

3 search heads, 1 deployer, 3 indexers

C.

1 search head, 1 deployer, 3 indexers

D.

2 search heads, 1 deployer, 3 indexers

Buy Now
Questions 36

How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?

Options:

A.

ITSI requires a dedicated deployment server.

B.

The amount of users using ITSI will not impact performance.

C.

ITSI in a Splunk deployment does not require additional hardware resources.

D.

Depending on the Key Performance Indicators that are being tracked, additional infrastructure may be needed.

Buy Now
Questions 37

Which of the following artifacts are included in a Splunk diag file? (Select all that apply.)

Options:

A.

OS settings.

B.

Internal logs.

C.

Customer data.

D.

Configuration files.

Buy Now
Questions 38

Which of the following clarification steps should be taken if apps are not appearing on a deployment client? (Select all that apply.)

Options:

A.

Check serverclass.conf of the deployment server.

B.

Check deploymentclient.conf of the deployment client.

C.

Check the content of SPLUNK_HOME/etc/apps of the deployment server.

D.

Search for relevant events in splunkd.log of the deployment server.

Buy Now
Questions 39

Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

Options:

A.

High performance SAN should never be used.

B.

Enable NFS for storing hot and warm buckets.

C.

The recommended RAID setup is RAID 10 (1 + 0).

D.

Virtualized environments are usually preferred over bare metal for Splunk indexers.

Buy Now
Questions 40

Which Splunk internal index contains license-related events?

Options:

A.

_audit

B.

_license

C.

_internal

D.

_introspection

Buy Now
Questions 41

By default, what happens to configurations in the local folder of each Splunk app when it is deployed to a search head cluster?

Options:

A.

The local folder is copied to the local folder on the search heads.

B.

The local folder is merged into the default folder and deployed to the search heads.

C.

Only certain . conf files in the local folder are deployed to the search heads.

D.

The local folder is ignored and only the default folder is copied to the search heads.

Buy Now
Questions 42

In splunkd. log events written to the _internal index, which field identifies the specific log channel?

Options:

A.

component

B.

source

C.

sourcetype

D.

channel

Buy Now
Questions 43

A search head cluster with a KV store collection can be updated from where in the KV store collection?

Options:

A.

The search head cluster captain.

B.

The KV store primary search head.

C.

Any search head except the captain.

D.

Any search head in the cluster.

Buy Now
Questions 44

To expand the search head cluster by adding a new member, node2, what first step is required?

Options:

A.

splunk bootstrap shcluster-config -mgmt_uri https://node2:8089 -replication_port 9200 -secret supersecretkey

B.

splunk init shcluster-config -master_uri https://node2:8089 -replication_port 9200 -secret supersecretkey

C.

splunk init shcluster-config -mgmt_uri https://node2:8089 -replication_port 9200 -secret supersecretkey

D.

splunk add shcluster-member -new_member_uri https://node2:8089 -replication_port 9200 -secret supersecretkey

Buy Now
Questions 45

Which of the following would be the least helpful in troubleshooting contents of Splunk configuration files?

Options:

A.

crash logs

B.

search.log

C.

btool output

D.

diagnostic logs

Buy Now
Questions 46

Which part of the deployment plan is vital prior to installing Splunk indexer clusters and search head clusters?

Options:

A.

Data source inventory.

B.

Data policy definitions.

C.

Splunk deployment topology.

D.

Education and training plans.

Buy Now
Questions 47

If .delta replication fails during knowledge bundle replication, what is the fall-back method for Splunk?

Options:

A.

.Restart splunkd.

B.

.delta replication.

C.

.bundle replication.

D.

Restart mongod.

Buy Now
Questions 48

When should a Universal Forwarder be used instead of a Heavy Forwarder?

Options:

A.

When most of the data requires masking.

B.

When there is a high-velocity data source.

C.

When data comes directly from a database server.

D.

When a modular input is needed.

Buy Now
Exam Code: SPLK-2002
Exam Name: Splunk Enterprise Certified Architect
Last Update: Mar 22, 2024
Questions: 160

PDF + Testing Engine

$75.95  $216.99

Testing Engine

$53.2  $151.99
buy now SPLK-2002 testing engine

PDF (Q&A)

$49  $139.99
buy now SPLK-2002 pdf
dumpsmate guaranteed to pass
24/7 Customer Support

DumpsMate's team of experts is always available to respond your queries on exam preparation. Get professional answers on any topic of the certification syllabus. Our experts will thoroughly satisfy you.

Site Secure

mcafee secure

TESTED 29 Mar 2024