SPLK-2002 Practice Test 5 — 25 Questions

Question 1

You are deploying a Search Head Cluster across multiple data centers. Which feature allows you to prioritize searches performed by users in the same site as the indexers?

Accepted Answer

Search affinity. Search affinity allows you to configure search heads to prioritize indexers within their own site to minimize cross-site traffic.

Answer

Site-aware routing

Answer

Data locality

Answer

Load balancing

Question 2

In an indexer cluster, what happens if the cluster master is permanently lost and you do not have a backup of the 'master-apps' directory?

Accepted Answer

You will be unable to distribute new configuration updates. The master-apps directory contains the source of truth for the cluster configuration; without it, the cluster configuration cannot be easily managed or restored to a new master.

Answer

The data is permanently lost

Answer

The indexers continue to work normally indefinitely

Answer

You can restore the configuration from the peer nodes

Question 3

You want to move an indexer peer to a different site in an existing multisite cluster. What is the procedure to ensure the cluster recognizes the new site mapping?

Accepted Answer

Change the site value in server.conf and restart the indexer. You must update the 'site' parameter in server.conf and restart the indexer; the CM will then recognize the new site mapping.

Answer

Run a rebalance command on the CM

Answer

Delete the indexer and re-add it

Answer

Modify the indexer's hostname

Question 4

In an indexer cluster, why might you use the 'splunk list cluster-peers' command?

Accepted Answer

To verify the synchronization status of all indexer peers. This command provides a status summary of all peers in the cluster, helping you verify that the cluster is healthy and all nodes are synchronized.

Answer

To remove a node from the cluster

Answer

To update the license configuration

Answer

To force a cluster rebalance

Question 5

You need to migrate a single-site Indexer Cluster to a multi-site configuration. What is the first step you must perform before modifying the server.conf on the Cluster Master?

Accepted Answer

Set the cluster to maintenance_mode=true.. You must put the cluster into maintenance mode to prevent the CM from attempting to rebalance buckets or trigger replication while you are actively reconfiguring the site topology.

Answer

Delete all existing buckets.

Answer

Configure the site-specific replication factors.

Answer

Upgrade the license server.

Answer

Disable all forwarder data ingestion.

Question 6

If a search head is overloaded with concurrent searches, what is the best strategy to offload the processing?

Accepted Answer

Implement a Search Head Cluster. Distributing searches across multiple search heads or using a search head cluster helps spread the load.

Answer

Increase the number of indexers

Answer

Reduce the number of users

Answer

Increase indexer memory

Question 7

When a search is running, what does the 'Dispatch' directory store?

Accepted Answer

Temporary search results and metadata. The dispatch directory stores temporary search artifacts, including results, logs, and metadata for ongoing and recently completed searches.

Answer

Indexed data

Answer

License information

Answer

App configuration files

Question 8

Which THREE settings in indexes.conf help manage bucket size and count?

Accepted Answer

frozenTimePeriodInSecs. maxDataSize, maxWarmDBCount, and frozenTimePeriodInSecs are key for managing bucket lifecycle and volume.

Answer

max_searches_per_cpu

Answer

index_concurrency

Question 9

Which of the following is a key advantage of using a Search Head Cluster over a single search head?

Accepted Answer

High availability of search and user interface. High availability is the primary design goal for SHC, allowing queries to be answered even if one node fails.

Answer

Faster indexing performance

Answer

Reduced license costs

Answer

Smaller storage footprint

Question 10

Which TWO of the following are true regarding the Splunk 'Deployment Server' (DS) in a clustered environment?

Accepted Answer

The DS is used to distribute apps to indexers. The DS manages apps for all components, but for indexer clusters, the CM manages the indexer-specific configuration bundles.

Answer

The DS is a mandatory component for indexer clusters

Answer

The DS should be used to update indexer cluster configurations

Answer

The DS manages the search head cluster captain election

Question 11

When adding a new indexer to an existing Indexer Cluster, what is the best practice to ensure the indexer is ready before it starts receiving data?

Accepted Answer

Start the splunk service and wait for the CM to acknowledge registration.. New peers must register with the Cluster Master and receive the latest configuration bundle before they can participate in indexing.

Answer

Set the indexer to maintenance mode.

Answer

Manually copy index buckets from other peers.

Answer

Restart all existing peers.

Answer

Add the indexer to the indexer discovery list.

Question 12

Which TWO of the following are prerequisites for a functional Search Head Cluster?

Accepted Answer

Open replication port between all members.. SHC nodes must be able to communicate via the replication port, and they must share the same security keys.

Answer

A shared network file system.

Answer

A dedicated license master.

Answer

A Cluster Master node.

Question 13

Which THREE of the following are key components of a disaster recovery plan for Splunk?

Accepted Answer

Off-site storage of frozen buckets.. Disaster recovery involves backing up critical configs, maintaining off-site copies of data, and having a restoration procedure.

Answer

Increasing the replication factor.

Answer

Continuous indexing of all data.

Question 14

Which dashboard in the Monitoring Console provides the best overview of resource consumption per search head?

Accepted Answer

Search Head Activity. The 'Search Head Activity' dashboard provides resource usage details specific to search heads.

Answer

Data Ingestion Performance

Answer

Resource Usage: Forwarders

Answer

Indexer Activity

Question 15

In a multi-site indexer cluster, which setting controls the number of copies of data kept per site?

Accepted Answer

site_replication_factor. The 'site_replication_factor' is configured in server.conf on the cluster master to define replication behavior across sites.

Answer

max_site_copies

Answer

site_data_count

Answer

cross_site_replication

Question 16

Which tool is best for monitoring the health and performance of the entire Splunk environment?

Accepted Answer

Monitoring Console. The Monitoring Console (MC) is the built-in tool for health and performance monitoring.

Answer

Splunk CLI

Answer

Deployment Server

Answer

Splunk Web UI

Question 17

Which THREE metrics are critical for monitoring indexer health in the Monitoring Console?

Accepted Answer

Memory usage. CPU, disk I/O, and memory usage are the fundamental hardware metrics for indexer health.

Answer

Number of active apps

Answer

Number of logged-in users

Question 18

Which component in an Indexer Cluster is responsible for assigning buckets to peers?

Accepted Answer

The Cluster Master. The Cluster Master (CM) manages the mapping of buckets to peer nodes.

Answer

The Search Head

Answer

The indexer peer itself

Answer

The Deployment Server

Question 19

What happens to a search job if the Search Head Cluster captain goes down during an active search?

Accepted Answer

A new captain is elected and search jobs are recovered.. The cluster will elect a new captain, and the search job will typically resume or be re-dispatched by the new captain depending on the state of the job.

Answer

The search head cluster becomes read-only.

Answer

Indexers stop processing data.

Answer

The entire cluster must be restarted.

Answer

The search job is canceled immediately.

Question 20

Which feature ensures that Search Head Cluster members share knowledge objects like saved searches and reports?

Accepted Answer

Search Head Cluster replication. Search Head Cluster members synchronize knowledge objects automatically using the replication service configured on the replication port.

Answer

Cluster Master

Answer

Index-time extraction

Answer

Bucket replication

Answer

Deployment Server