Candidates must design and configure indexer and search head clusters, ensuring data replication and configuration consistency. The most critical thing is to correctly set replication and search factors and use the deployer for search head cluster configuration.
Start practicing
Deployment Architecture And Clustering — choose a session length
Free · No account required
Domain overview
This domain covers Splunk Enterprise deployment architecture, focusing on indexer clusters and search head clusters. It tests your ability to design, configure, and troubleshoot distributed components like the cluster master, peer nodes, and deployer. Questions assess understanding of replication, search factor, and configuration management, ensuring you can maintain data availability and search functionality in clustered environments.
Exam objectives
Cluster master's role in coordinating peer nodes and managing bucket replication
Search head cluster deployer for distributing apps and configurations to members
Replication factor and search factor settings in server.conf for indexer clusters
Bucket storage locations on peer nodes and data distribution across the cluster
Confusing replication factor (copies of raw data) with search factor (searchable copies), leading to incorrect availability assumptions.
Editing configurations directly on search head cluster members instead of using the deployer, causing bundle conflicts and overwrites.
Assuming the cluster master stores indexed data, when it only manages cluster state and metadata.
Click any question to see the full explanation and answer options, or start a focused practice session above.
When planning a deployment, which component is required to act as the primary communication hub for managing configuration bundles in an Indexer Cluster?
2You are configuring a Search Head Cluster and need to ensure that local user configurations are not overwritten by cluster-wide bundles. What is the correct way to handle these local configurations?
3When implementing a multisite indexer cluster, what happens if the cluster master becomes unreachable for a short duration?
4Which component in an Indexer Cluster is responsible for assigning buckets to peers?
5You are deploying a Search Head Cluster across multiple data centers. Which feature allows you to prioritize searches performed by users in the same site as the indexers?
6What is the primary function of the 'search_factor' in an indexer cluster?
7A new indexer is added to a cluster. How does the cluster handle the historical data that already exists on other indexers?
8When configuring a Search Head Cluster, what is the purpose of the 'replication_factor' setting in server.conf?
9In an indexer cluster, what happens if the cluster master is permanently lost and you do not have a backup of the 'master-apps' directory?
10You are troubleshooting a Search Head Cluster where a member node cannot join the cluster. Which log file on the node is the most useful for diagnosing the communication issue?
11Which of the following is a key advantage of using a Search Head Cluster over a single search head?
12You are tasked with upgrading an Indexer Cluster. Which order of operations is recommended by Splunk best practices?
13When designing a large-scale multisite cluster, which factor most significantly impacts the search performance when running searches across all sites?
14In an Indexer Cluster, which component stores the 'bucket' index files?
15A search head cluster is currently running in a degraded state because the 'captain' has failed. What is the expected behavior?
16What must be installed on all Search Head Cluster members before they can join the cluster?
17You want to move an indexer peer to a different site in an existing multisite cluster. What is the procedure to ensure the cluster recognizes the new site mapping?
18Which THREE factors should be considered when planning the hardware requirements for a multisite indexer cluster?
19Which TWO are common causes of 'Search Head Cluster' configuration replication failures?
20What is the primary function of the 'Cluster Master' in an Indexer Cluster?
21When configuring a Search Head Cluster, what does the 'captain' role do that other members do not?
22When adding a new indexer to a multisite cluster, which attribute must be correctly set in the configuration before joining the cluster?
23In an indexer cluster, why might you use the 'splunk list cluster-peers' command?
24Which component in Splunk is required to be the central point for managing licenses in a clustered environment?
25You manage a Splunk indexer cluster with three peer nodes, a cluster manager, and a search head. The search head is configured with the cluster manager's URI in its server.conf under [clustering]. A new compliance requirement mandates that all searchable data copies must remain on the original peer that indexed the data, and replication to other peers is strictly prohibited. What should you do to meet this requirement while keeping the cluster functional?
26A Splunk indexer cluster has three peer nodes (peer1, peer2, peer3) and one cluster master. The replication factor is 3 and the search factor is 2. Peer2 suffers a disk failure and goes offline for 48 hours. After peer2 is repaired and rejoins the cluster, the cluster master begins replicating buckets to it. Which statement accurately describes the state of the cluster immediately after peer2 rejoins?
27A Splunk search head cluster has five members. The captain is responsible for coordinating configuration replication and search artifacts. The administrator notices that the captain has not been elected for over an hour, and the cluster is unable to replicate configurations. Which condition is the most likely cause?
28A Splunk indexer cluster is configured with a replication factor of 3 and a search factor of 2. The cluster has five peer nodes. A bucket is currently searchable on two peers. The cluster master detects that one of those peers has failed. What immediate action does the cluster master take to maintain the search factor?
29A Splunk administrator is configuring a search head cluster with three members. They want to ensure that if the captain fails, the cluster can still elect a new captain and continue operating. Which configuration must be in place to allow captain election to succeed?
Candidates must design and configure indexer and search head clusters, ensuring data replication and configuration consistency. The most critical thing is to correctly set replication and search factors and use the deployer for search head cluster configuration.
The Courseiva SPLK-2002 question bank contains 29 questions in the Deployment Architecture And Clustering domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Deployment Architecture And Clustering domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included