[Dec 03, 2021] Latest SPLK-2002 Exam with Accurate Splunk Enterprise Certified Architect PDF Questions
Practice To SPLK-2002 - ITExamSimulator Remarkable Practice On your Splunk Enterprise Certified Architect Exam
Conclusion
The Splunk SPLK-2002 exam leads to one of the most highly-rated Splunk certifications, which equips an architect with the relevant knowledge needed for the desired boost in their career. The test assesses one's knowledge of the different uses of the Splunk Enterprise environment and how to apply it when performing daily tasks. It paves way for advancement and assimilation into some of the most rewarding Splunk careers.
NEW QUESTION 52
Which Splunk internal index contains license-related events?
- A. _introspection
- B. _audit
- C. _internal
- D. _license
Answer: C
NEW QUESTION 53
When should multiple search pipelines be enabled?
- A. Only if CPU and memory resources are significantly under-utilized.
- B. Only if disk IOPS is at 800 or better.
- C. Only if there are fewer than twelve concurrent users.
- D. Only if running Splunk Enterprise version 6.6 or later.
Answer: A
NEW QUESTION 54
Which of the following describe migration from single-site to multisite index replication?
- A. Multisite policies apply to new data only.
- B. Single-site buckets instantly receive the multisite policies.
- C. A master node is required at each site.
- D. Multisite total values should not exceed any single-site factors.
Answer: D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Migratetomultisite
NEW QUESTION 55
Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?
- A. Increase the number of parallel ingestion pipelines in server.conf
- B. Decrease the maximum size of the search pipelines in limits.conf
- C. Increase the maximum number of hot buckets in indexes.conf
- D. Decrease the maximum concurrent scheduled searches in limits.conf
Answer: D
NEW QUESTION 56
When adding or rejoining a member to a search head cluster, the following error is displayed:
Error pulling configurations from the search head cluster captain; consider performing a destructive
configuration resync on this search head cluster member.
What corrective action should be taken?
- A. Run the splunk resync shcluster-replicated-configcommand on this member.
- B. Restart the search head.
- C. Run the clean raftcommand on all members of the search head cluster.
- D. Run the splunk apply shcluster-bundlecommand from the deployer.
Answer: D
NEW QUESTION 57
A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master. How much data can the customer ingest before search is locked out?
- A. 800GB. After this limit, search is locked out.
- B. 300GB. After this limit, search is locked out.
- C. Search is not locked out. Violations are still recorded.
- D. 500GB. After this limit, search is locked out.
Answer: C
NEW QUESTION 58
Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its
capacity. Which of the following options will provide the most search performance improvement?
- A. Look for slow searches and reschedule them to run during an off-peak time.
- B. Replace the indexer storage to solid state drives (SSD).
- C. Add more search peers and make sure forwarders distribute data evenly across all indexers.
- D. Add more search heads and redistribute users based on the search type.
Answer: A
NEW QUESTION 59
When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?
- A. Auto
- B. True
- C. None
- D. False
Answer: B
NEW QUESTION 60
Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the
_introspectionindex. Which of the following logs are included in this index? (Select all that apply.)
- A. disk_objects.log
- B. metrics.log
- C. resource_usage.log
- D. audit.log
Answer: A,C
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Troubleshooting/ Abouttheplatforminstrumentationframework
NEW QUESTION 61
What is the algorithm used to determine captaincy in a Splunk search head cluster?
- A. Raft distributed consensus.
- B. Rift distributed consensus.
- C. Rapt distributed consensus.
- D. Round-robin distribution consensus.
Answer: A
NEW QUESTION 62
Which search will show all deployment client messages from the client (UF)?
- A. index=_audit component=DC* host=<ds> | stats count by message
- B. index=_audit component=DC* host=<uf> | stats count by message
- C. index=_internal component= DC* host=<uf> | stats count by message
- D. index=_internal component=DS* host=<ds> | stats count by message
Answer: D
Explanation:
Explanation/Reference: https://answers.splunk.com/answers/461939/after-all-clients-are-registered-to-a-deployment-s.html
NEW QUESTION 63
Configurations from the deployer are merged into which location on the search head cluster member?
- A. SPLUNK_HOME/etc/apps/search/default
- B. SPLUNK_HOME/etc/apps/APP_HOME/local
- C. SPLUNK_HOME/etc/apps/APP_HOME/default
- D. SPLUNK_HOME/etc/system/local
Answer: D
NEW QUESTION 64
Which Splunk server role regulates the functioning of indexer cluster?
- A. Monitoring Console
- B. Master Node
- C. Deployer
- D. Indexer
Answer: B
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Deploy/Indexercluster
NEW QUESTION 65
How does the average run time of all searches relate to the available CPU cores on the indexers?
- A. Average run time increases as the number of CPU cores on the indexers increases.
- B. Average run time decreases as the number of CPU cores on the indexers decreases.
- C. Average run time increases as the number of CPU cores on the indexers decreases.
- D. Average run time is independent of the number of CPU cores on the indexers.
Answer: C
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/
Accommodatemanysimultaneoussearches
NEW QUESTION 66
Which of the following clarification steps should be taken if apps are not appearing on a deployment client?
(Select all that apply.)
- A. Check deploymentclient.conf of the deployment client.
- B. Search for relevant events in splunkd.log of the deployment server.
- C. Check the content of SPLUNK_HOME/etc/apps of the deployment server.
- D. Check serverclass.conf of the deployment server.
Answer: A,C,D
NEW QUESTION 67
Which of the following are true statements about Splunk indexer clustering?
- A. The peer nodes must run the same or a later Splunk version than the master node.
- B. The master node must run the same or a later Splunk version than search heads.
- C. The search head must run the same or a later Splunk version than the peer nodes.
- D. All peer nodes must run exactly the same Splunk version.
Answer: B
NEW QUESTION 68
Which of the following statements describe search head clustering? (Select all that apply.)
- A. The deployer must have sufficient CPU and network resources to process service requests and push configurations.
- B. At least three search heads are needed.
- C. Search heads must meet the high-performance reference server requirements.
- D. A deployer is required.
Answer: C,D
NEW QUESTION 69
Which of the following clarification steps should be taken if apps are not appearing on a deployment client?
(Select all that apply.)
- A. Check the content of SPLUNK_HOME/etc/appsof the deployment server.
- B. Search for relevant events in splunkd.logof the deployment server.
- C. Check serverclass.confof the deployment server.
- D. Check deploymentclient.confof the deployment client.
Answer: A,C,D
Explanation:
Explanation/Reference: https://answers.splunk.com/answers/177021/why-is-deployment-client-not-picking-up-changes- to.html
NEW QUESTION 70
Which of the following are client filters available in serverclass.conf? (Select all that apply.)
- A. Platform (machine type).
- B. IP address.
- C. Splunk server role.
- D. DNS name.
Answer: B,D
NEW QUESTION 71
The KV store forms its own cluster within a SHC. What is the maximum number of SHC members KV store will
form?
- A. Unlimited
- B. 0
- C. 1
- D. 2
Answer: A
NEW QUESTION 72
Which of the following should be done when installing Enterprise Security on a Search Head Cluster? (Select
all that apply.)
- A. Copy the Enterprise Security configurations to the deployer.
- B. Install Enterprise Security on a staging instance.
- C. Use the deployer to deploy Enterprise Security to the cluster members.
- D. Install Enterprise Security on the deployer.
Answer: C,D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/ES/5.3.1/Install/InstallEnterpriseSecuritySHC
NEW QUESTION 73
A search head has successfully joined a single site indexer cluster. Which command is used to configure the same search head to join another indexer cluster?
- A. splunk edit cluster-master
- B. splunk add cluster-master
- C. splunk add cluster-config
- D. splunk edit cluster-config
Answer: B
NEW QUESTION 74
......
Exam Questions and Answers for SPLK-2002 Study Guide Questions and Answers!: https://www.itexamsimulator.com/SPLK-2002-brain-dumps.html
Practice To SPLK-2002 - ITExamSimulator Remarkable Practice On your Splunk Enterprise Certified Architect Exam: https://drive.google.com/open?id=1Y3pYEtjLl74q8H7wBtsf7NDHauMFbONq
