SPLK-2002 Practice Test 7 — 10 Questions

Question 1

When configuring a Search Head Cluster, what does the 'captain' role do that other members do not?

Accepted Answer

It manages the cluster membership and configuration replication. The captain in a Search Head Cluster (SHC) is elected from among the members and is responsible for managing cluster membership, replicating configuration changes (via the deployer-pushed configs and the SHC's internal replication), and coordinating artifact replication. Other members perform searches and serve users but do not handle these cluster-management duties.

Answer

It acts as the primary user interface node

Answer

It stores all the search results

Answer

It performs all the searches for the cluster

Question 2

When managing indexer clustering, what is the impact of a high 'replication_factor' on indexing performance?

Accepted Answer

Increases indexing latency due to synchronous replication requirements. A high replication_factor means each bucket must be replicated to more indexer peers before the data is considered safely indexed. Because replication is synchronous for hot buckets in an indexer cluster, the indexing pipeline waits for acknowledgments from all required peers, increasing indexing latency. This is the direct performance impact.

Answer

Allows for faster data ingestion without resource constraints

Answer

Improves search speed by reducing data density

Answer

Decreases indexer storage requirements

Question 3

An Indexer Cluster is in 'Maintenance Mode'. Which THREE of the following implications must be considered during this time?

Accepted Answer

The peers will continue to index incoming data normally. In Splunk maintenance mode, option A is correct because the indexer peers keep indexing incoming data normally; maintenance mode only suppresses certain master-level activities, not data ingestion. Option B is correct because the cluster master stops alerting on missing buckets, so replication/primacy violations are not reported during this window. Option E is correct because the master also halts bucket fix-up activities, meaning it will not attempt to search for and replicate or restore missing bucket copies. Option C is wrong because the master does not force an immediate bucket re-balance in maintenance mode; rebalancing is a separate, manual operation. Option D is wrong because searches are not automatically disabled by maintenance mode; search functionality continues unless separately restricted.

Answer

The Master will force a bucket re-balance immediately

Answer

All searches will be automatically disabled

Question 4

What happens to a search job if the Search Head Cluster captain goes down during an active search?

Accepted Answer

A new captain is elected and search jobs are recovered.. In a Search Head Cluster, the captain is a dynamically elected member that coordinates configuration replication and search scheduling. If the captain goes down, a new captain is elected from the remaining members, and active search jobs are recovered and continue. This provides high availability and fault tolerance.

Answer

The search head cluster becomes read-only.

Answer

Indexers stop processing data.

Answer

The entire cluster must be restarted.

Answer

The search job is canceled immediately.

Question 5

When configuring search affinity for a multi-site cluster, what is the behavior if no indexers are available in the local site?

Accepted Answer

The search head queries indexers in other sites.. In a Splunk multi-site cluster, search affinity is a performance optimization that prefers indexers in the same site as the search head to reduce latency and WAN traffic. However, it is not a hard constraint: if no indexers in the local site are available (e.g., all are down, busy, or in maintenance mode), the search head automatically falls back to querying indexers in other sites. This ensures search continuity and availability, which is a core design goal of Splunk's distributed search architecture.

Answer

The search fails immediately.

Answer

The search head waits for the local indexer to return.

Answer

The search head only returns partial results.

Answer

The search head reports an error to the user.

Question 6

You are troubleshooting a configuration bundle replication issue in an Indexer Cluster. The peers are not receiving the latest configuration from the Master. What is the first thing you should check on the Cluster Master?

Accepted Answer

splunk validate cluster-bundle. When peers are not receiving the latest configuration bundle, the first diagnostic step on the Cluster Master is to validate the bundle with 'splunk validate cluster-bundle'. This command checks the bundle for syntax errors, invalid configurations, or missing files before it is pushed to peers, and it reports exactly what is wrong so you can fix the source rather than guessing.

Answer

Check the replication_port

Answer

Restart the Master

Answer

Check /etc/apps for errors

Question 7

What is the purpose of the 'homePath.maxDataSizeMB' setting in indexes.conf?

Accepted Answer

Limits the total size of all hot/warm buckets in the homePath. homePath.maxDataSizeMB sets the maximum total size, in megabytes, of all hot and warm buckets stored in the index's homePath. When this limit is reached, Splunk rolls the oldest warm buckets to the coldPath to free space, making it a retention and capacity control for the homePath volume.

Answer

Sets the maximum size of a single hot bucket

Answer

Limits the number of buckets to 100

Answer

Sets the size limit for the cold path

Question 8

Which TWO items are stored in the index directory?

Accepted Answer

TSIDX files. In Splunk, the index directory (e.g., $SPLUNK_HOME/var/lib/splunk/defaultdb/db) stores the indexed data itself, which includes both the rawdata files (compressed journal slices) and the TSIDX files that hold the time-series index used to locate events quickly, so options B and C are correct. TSIDX files map timestamps and terms to the rawdata slices, and the rawdata files are the compressed, bucket-organized copies of the ingested events. License master keys are not stored in the index directory; they are managed by the license manager (in $SPLUNK_HOME/etc/licenses or the license pool configuration). Search logs are written to $SPLUNK_HOME/var/log/splunk (e.g., search.log per search job), not the index directory. App configuration files live under $SPLUNK_HOME/etc/apps (and related etc directories), not in the index storage.

Answer

License master keys

Answer

Search logs

Answer

App configuration files

Question 9

If an Indexer Cluster has a replication_factor of 3 and search_factor of 2, how many searchable copies of a bucket are maintained across the cluster?

Accepted Answer

2. In an Indexer Cluster, the search_factor defines how many searchable copies of each bucket are maintained across the cluster. With a search_factor of 2, exactly two searchable copies of each bucket exist. The replication_factor (3) determines the total number of copies (searchable plus non-searchable), but the search_factor specifically governs searchable copies.

Answer

5

Answer

4

Answer

1

Answer

3

Question 10

Which THREE components are part of the Splunk index directory structure?

Accepted Answer

coldPath. In Splunk's indexes.conf, each index defines three path settings that make up its on-disk directory structure: coldPath (B), homePath (D), and thawedPath (E). homePath holds the hot and warm buckets (the newly written, actively searchable data), coldPath stores buckets that have rolled from warm to cold, and thawedPath is where archived buckets are restored when an admin runs the rebuild command to bring them back online. These three are the actual configurable path attributes of an index, so B, D, and E are correct. The other options are not valid index path settings: hotPath (A) and warmPath (C) do not exist as separate configuration keys because hot and warm buckets both reside under homePath, so they are not part of the index directory structure.

Answer

hotPath

Answer

warmPath