SPLK-2002 Practice Test 8 — 10 Questions

Question 1

Which THREE of the following are valid states for a bucket in an Indexer Cluster?

Accepted Answer

Cold. Buckets transition through hot, warm, and cold states during their lifecycle in an indexer cluster.

Answer

Active

Answer

Pending

Question 2

An architect is designing an index lifecycle for compliance. The requirement is to keep data for exactly 7 years. Which setting must be configured to prevent premature deletion?

Accepted Answer

frozenTimePeriodInSecs. frozenTimePeriodInSecs must be set to the equivalent of 7 years in seconds.

Answer

maxTotalDataSizeMB

Answer

maxWarmDBCount

Answer

maxHotSpanSecs

Question 3

When configuring a Search Head Cluster, what is the purpose of the 'deployer'?

Accepted Answer

To manage the replication of search configurations. The deployer is used to distribute configuration bundles (apps) to all search heads in the cluster.

Answer

To coordinate the election of the captain

Answer

To act as a load balancer for users

Answer

To store the search results for the cluster

Question 4

Which TWO of these are valid methods for controlling bucket retention?

Accepted Answer

maxTotalDataSizeMB. Retention is controlled by time or size (total disk space).

Answer

maxWarmDBCount

Answer

maxHotSpanSecs

Answer

index_auto_delete

Question 5

You are designing a multi-site Indexer Cluster with two sites. To ensure search availability during a site failure, which configuration is mandatory in the site_replication_factor stanza of server.conf?

Accepted Answer

Define explicit replication counts for each site using 'siteN' syntax.. In a multi-site cluster, the total replication factor must be the sum of site-specific replication factors, and each site must be explicitly defined to ensure data is distributed across sites.

Answer

Enable search_factor to 2 for all sites.

Answer

Set replication_factor to 1 on each site.

Answer

Set cluster_mode to 'multisite_master'.

Answer

Configure the indexer as a site-local peer.

Question 6

You notice that your indexer cluster has buckets in a 'Searchable' state but some are marked as 'Streaming'. What does this indicate?

Accepted Answer

Bucket replication is in progress to other peers. Streaming buckets are typically related to the replication of data from a primary to a secondary node; if they stay in this state, it may indicate replication lag.

Answer

The bucket is corrupt

Answer

The indexer is performing a hot-to-warm rollover

Answer

The data is being archived to cold storage

Question 7

Which THREE conditions must be met for an indexer to be successfully added to an Indexer Cluster?

Accepted Answer

The indexer must have network connectivity to the CM. The indexer needs the same pass4SymmKey, network access to the CM, and to be in an uninitialized state.

Answer

The indexer must be running on the same OS version as the CM

Answer

The indexer must be designated as a search head

Question 8

Which TWO types of storage can be used for indexer data?

Accepted Answer

Object storage (SmartStore). Splunk supports local storage and network storage (NAS/SAN) or object storage for SmartStore.

Answer

USB flash drives

Answer

Search head cache

Answer

Temporary memory storage

Question 9

What is the primary function of the 'Cluster Secret' in a Splunk Indexer Cluster?

Accepted Answer

To secure the communication between cluster nodes.. The secret acts as a shared password to ensure that only authorized peers can join the cluster and communicate with the Cluster Master.

Answer

To define the replication factor.

Answer

To authorize search head access.

Answer

To manage indexer licensing.

Answer

To encrypt data in flight.

Question 10

Which THREE of the following are common causes for a Search Head Cluster member to lose contact with the captain?

Accepted Answer

Service load is too high causing timeouts.. Loss of contact is often due to network issues, replication port blockage, or excessive load causing timeout.

Answer

License master is offline.

Answer

The indexer cluster is busy.