SPLK-2002 Deployment Architecture And Clustering Practice Test 2 — 15 Questions

Question 1

A customer needs to decommission a single indexer peer from an Indexer Cluster without losing data. Which step is mandatory to ensure all data is safely migrated to other peers?

Accepted Answer

Run 'splunk remove cluster-peers' on the CM. Putting the indexer into 'maintenance_mode' or using the 'splunk remove cluster-peers' command allows the cluster to redistribute buckets.

Answer

Force a cluster bundle update

Answer

Delete the indexer directory on the CM

Answer

Simply shut down the indexer service

Question 2

You notice that your indexer cluster has buckets in a 'Searchable' state but some are marked as 'Streaming'. What does this indicate?

Accepted Answer

Bucket replication is in progress to other peers. Streaming buckets are typically related to the replication of data from a primary to a secondary node; if they stay in this state, it may indicate replication lag.

Answer

The bucket is corrupt

Answer

The indexer is performing a hot-to-warm rollover

Answer

The data is being archived to cold storage

Question 3

What is the primary function of the 'search_factor' in an indexer cluster?

Accepted Answer

The number of searchable copies of each bucket. The search_factor dictates how many copies of the searchable data are maintained in the cluster to ensure high availability for search queries.

Answer

The maximum number of concurrent searches

Answer

The number of indexer peers in the cluster

Answer

The number of search heads allowed in the cluster

Question 4

A new indexer is added to a cluster. How does the cluster handle the historical data that already exists on other indexers?

Accepted Answer

The cluster redistributes buckets only if necessary to meet factors. Existing data is not automatically replicated to the new node unless it is required to satisfy the replication factor or search factor settings.

Answer

The new node only receives new data

Answer

The cluster forces a reindex of all historical data

Answer

All historical data is immediately copied to the new node

Question 5

When configuring a Search Head Cluster, what is the purpose of the 'replication_factor' setting in server.conf?

Accepted Answer

To define the number of copies of search artifacts. In an SHC, the replication_factor defines how many copies of the search-related configurations are replicated across members.

Answer

To limit the number of users

Answer

To specify the number of search nodes in the cluster

Answer

To balance the search load across nodes

Question 6

In an indexer cluster, what happens if the cluster master is permanently lost and you do not have a backup of the 'master-apps' directory?

Accepted Answer

You will be unable to distribute new configuration updates. The master-apps directory contains the source of truth for the cluster configuration; without it, the cluster configuration cannot be easily managed or restored to a new master.

Answer

The data is permanently lost

Answer

The indexers continue to work normally indefinitely

Answer

You can restore the configuration from the peer nodes

Question 7

You are troubleshooting a Search Head Cluster where a member node cannot join the cluster. Which log file on the node is the most useful for diagnosing the communication issue?

Accepted Answer

splunkd.log. The 'splunkd.log' file contains detailed information about search head cluster communication, heartbeat, and member joining processes.

Answer

web_access.log

Answer

audit.log

Answer

metrics.log

Question 8

Which of the following is a key advantage of using a Search Head Cluster over a single search head?

Accepted Answer

High availability of search and user interface. High availability is the primary design goal for SHC, allowing queries to be answered even if one node fails.

Answer

Faster indexing performance

Answer

Reduced license costs

Answer

Smaller storage footprint

Question 9

You are tasked with upgrading an Indexer Cluster. Which order of operations is recommended by Splunk best practices?

Accepted Answer

Upgrade the Cluster Master first, then the indexer peers. You should always upgrade the Cluster Master first to ensure it can manage the upgraded peer nodes.

Answer

Upgrade the search heads first

Answer

Upgrade all components simultaneously

Answer

Upgrade the indexer peers first, then the Cluster Master

Question 10

When designing a large-scale multisite cluster, which factor most significantly impacts the search performance when running searches across all sites?

Accepted Answer

Network latency between sites. Cross-site network latency is the biggest bottleneck for search performance in multisite indexer clusters.

Answer

The number of buckets per indexer

Answer

The number of users

Answer

The number of search heads

Question 11

In an Indexer Cluster, which component stores the 'bucket' index files?

Accepted Answer

Indexer Peer. The indexer peers are the nodes that perform the indexing and store the data in buckets.

Answer

Search Head

Answer

Cluster Master

Answer

Deployment Server

Question 12

A search head cluster is currently running in a degraded state because the 'captain' has failed. What is the expected behavior?

Accepted Answer

A new captain is elected automatically. In an SHC, if the captain fails, the remaining members will automatically perform an election to choose a new captain, allowing the cluster to continue operating.

Answer

The cluster stops processing all searches

Answer

The cluster automatically reverts to standalone mode

Answer

Manual intervention is required to elect a new captain

Question 13

What must be installed on all Search Head Cluster members before they can join the cluster?

Accepted Answer

The same security key. All members must have the same security key (configured in server.conf) to communicate securely within the cluster.

Answer

A shared SSL certificate

Answer

A dedicated storage partition

Answer

A specialized Splunk App

Question 14

You want to move an indexer peer to a different site in an existing multisite cluster. What is the procedure to ensure the cluster recognizes the new site mapping?

Accepted Answer

Change the site value in server.conf and restart the indexer. You must update the 'site' parameter in server.conf and restart the indexer; the CM will then recognize the new site mapping.

Answer

Run a rebalance command on the CM

Answer

Delete the indexer and re-add it

Answer

Modify the indexer's hostname

Question 15

Which TWO of the following are true regarding the Splunk 'Deployment Server' (DS) in a clustered environment?

Accepted Answer

The DS is used to distribute apps to indexers. The DS manages apps for all components, but for indexer clusters, the CM manages the indexer-specific configuration bundles.

Answer

The DS is a mandatory component for indexer clusters

Answer

The DS should be used to update indexer cluster configurations

Answer

The DS manages the search head cluster captain election