[Jun-2022] Verified Splunk Exam Dumps with SPLK-2002 Exam Study Guide [Q25-Q47]

Rate this post

[Jun-2022] Verified Splunk Exam Dumps with SPLK-2002 Exam Study Guide

Best Quality Splunk SPLK-2002 Exam Questions ExamsTorrent Realistic Practice Exams [2022]

NO.25 When Splunk is installed, where are the internal indexes stored by default?

SPLUNK_HOME/bin

SPLUNK_HOME/var/lib

SPLUNK_HOME/var/run

SPLUNK_HOME/etc/system/default

NO.26 What does setting site=site0on all Search Head Cluster members do in a multi-site indexer cluster?

Disables search site affinity.

Sets all members to dynamic captaincy.

Enables multisite search artifact replication.

Enables automatic search site affinity discovery.

NO.27 To reduce the captain’s work load in a search head cluster, what setting will prevent scheduled searches from
running on the captain?

adhoc_searchhead = true(on all members)

adhoc_searchhead = true(on the current captain)

captain_is_adhoc_searchhead = true(on all members)

captain_is_adhoc_searchhead = true(on the current captain)

NO.28 In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files.
What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?

Total daily indexing volume, number of peer nodes, and number of accelerated searches.

Total daily indexing volume, number of peer nodes, replication factor, and search factor.

Total daily indexing volume, replication factor, search factor, and number of search heads.

Replication factor, search factor, number of accelerated searches, and total disk size across cluster.

NO.29 Which of the following security options must be explicitly configured (i.e. which options are not enabled by
default)?

Data encryption between Splunk Web and splunkd.

Certificate authentication between forwarders and indexers.

Certificate authentication between Splunk Web and search head.

Data encryption for distributed search between search heads and indexers.

NO.30 A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)

The field was extracted as a private knowledge object.

The events are tagged as communicate, but are missing the network tag.

The Typing Queue, which does regular expression replacements, is blocked.

The colleague did not explicitly use the field in the search and the search was set to Fast Mode.

NO.31 When planning a search head cluster, which of the following is true?

All search heads must use the same operating system.

All search heads must be members of the cluster (no standalone search heads).

The search head captain must be assigned to the largest search head in the cluster.

All indexers must belong to the underlying indexer cluster (no standalone indexers).

NO.32 Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its
capacity. Which of the following options will provide the most search performance improvement?

Replace the indexer storage to solid state drives (SSD).

Add more search heads and redistribute users based on the search type.

Look for slow searches and reschedule them to run during an off-peak time.

Add more search peers and make sure forwarders distribute data evenly across all indexers.

NO.33 Which component in the splunkd.log will log information related to bad event breaking?

Audittrail

EventBreaking

IndexingPipeline

AggregatorMiningProcessor

NO.34 When using the props.conf LINE_BREAKERattribute to delimit multi-line events, the SHOULD_LINEMERGE
attribute should be set to what?

Auto

None

True

False

NO.35 Which of the following is an indexer clustering requirement?

Must use shared storage.

Must reside on a dedicated rack.

Must have at least three members.

Must share the same license pool.

NO.36 Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?

System local directory.

System default directory.

App local directories, in ASCII order.

App default directories, in ASCII order.

NO.37 When configuring a Splunk indexer cluster, what are the default values for replication and search factor?

replication_factor = 2search_factor = 2

replication_factor = 2search factor = 3

replication_factor = 3search_factor = 2

replication_factor = 3search factor = 3

NO.38 Stakeholders have identified high availability for searchable data as their top priority. Which of the following
best addresses this requirement?

Increasing the search factor in the cluster.

Increasing the replication factor in the cluster.

Increasing the number of search heads in the cluster.

Increasing the number of CPUs on the indexers in the cluster.

NO.39 Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

High performance SAN should never be used.

Enable NFS for storing hot and warm buckets.

The recommended RAID setup is RAID 10 (1 + 0).

Virtualized environments are usually preferred over bare metal for Splunk indexers.

NO.40 Splunk Enterprise platform instrumentation refers to data that the Splunk Enterprise deployment logs in the _introspection index. Which of the following logs are included in this index? (Select all that apply.)

audit.log

metrics.log

disk_objects.log

resource_usage.log

NO.41 Which of the following is an indexer clustering requirement?

Must use shared storage.

Must reside on a dedicated rack.

Must have at least three members.

Must share the same license pool.

NO.42 When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

1. Delete Splunk Enterprise, if it exists.
2. Install and initialize the instance.
3. Join the SHC.

1. Install and initialize the instance.
2. Delete Splunk Enterprise, if it exists.
3. Join the SHC.

1. Initialize cluster rebalance operation.
2. Remove master node from cluster.
3. Trigger replication.

1. Trigger replication.
2. Remove master node from cluster.
3. Initialize cluster rebalance operation.

NO.43 Which search head cluster component is responsible for pushing knowledge bundles to search peers, replicating configuration changes to search head cluster members, and scheduling jobs across the search head cluster?

Master

Captain

Deployer

Deployment server

NO.44 To improve Splunk performance, parallelIngestionPipelines setting can be adjusted on which of the following components in the Splunk architecture? (Select all that apply.)

Indexers

Forwarders

Search head

Cluster master

NO.45 Which of the following are true statements about Splunk indexer clustering?

All peer nodes must run exactly the same Splunk version.

The master node must run the same or a later Splunk version than search heads.

The peer nodes must run the same or a later Splunk version than the master node.

The search head must run the same or a later Splunk version than the peer nodes.

NO.46 Before users can use a KV store, an admin must create a collection. Where is a collection is defined?

kvstore.conf

collection.conf