SPLK-2002 High Availability And Distributed Search Practice Test 2 — 15 Questions

Question 1

Which THREE of the following are components involved in a distributed search architecture?

Accepted Answer

Deployment Server. In a distributed search architecture, the Search Head (B) is the component that receives and dispatches search requests, coordinates the search across peers, and consolidates the results returned to the user. The Indexer (D) is the component that stores the indexed data and performs the actual search processing on its local buckets, returning partial results to the search head. The Deployment Server (A) is also part of the distributed search ecosystem because it distributes configuration and app bundles to search heads, indexers, and forwarders, ensuring consistent knowledge objects and settings across the distributed deployment. An Application Server (C) and a Database Server (E) are generic enterprise roles not specific to distributed search; they are not search-head, indexer, or deployment-management components in this architecture.

Answer

Application Server

Answer

Database Server

Question 2

Which TWO of the following are true about the 'splunk apply shcluster-bundle' command?

Accepted Answer

It distributes configuration bundles to all members.. Option A is correct because 'splunk apply shcluster-bundle' is the CLI command used to push the current configuration bundle from the deployer (or captain) out to all members of the search head cluster, ensuring every member receives the same updated configuration. Option D is correct because after the bundle is distributed, the search head cluster members must be restarted (or the bundle must be applied with the appropriate restart behavior) for the new configuration to take effect, since bundle application on an SHC requires a restart of the members. Option B is incorrect because indexer cluster management uses different commands such as 'splunk apply cluster-bundle' on the master node, not the shcluster-bundle command. Option C is incorrect because 'splunk apply shcluster-bundle' must be run from the deployer (or the captain in certain configurations), not from any arbitrary search head cluster member. Option E is incorrect because the '--skip-version-check' flag is not a required flag for this command; it is optional and only used to bypass version compatibility checks in specific situations.

Answer

It is used for indexer cluster management.

Answer

It can be run from any SHC member.

Answer

It requires the '--skip-version-check' flag.

Question 3

Which TWO of the following are true about Indexer Discovery?

Accepted Answer

It dynamically provides a list of indexers to forwarders.. Indexer Discovery is a Splunk mechanism that dynamically provides forwarders with the current list of peer indexers in an indexer cluster, so option C is correct because the master node pushes the updated peer list to forwarders via the indexer discovery endpoint. Option E is correct because Indexer Discovery relies on the indexer cluster's master node to supply that peer list, meaning the indexers must belong to an Indexer Cluster. Option A is incorrect because Indexer Discovery is a forwarder-to-indexer mechanism, not a way for SHC members to locate indexers; SHC members use their own search head clustering configuration. Option B is incorrect because Indexer Discovery is configured on the forwarders (typically via outputs.conf with indexerDiscovery), not on every forwarder as a universal requirement in the sense implied, and it is not a mandatory setting for all forwarders. Option D is incorrect because Indexer Discovery does not replace a load balancer; it is an alternative distribution method, and load balancers can still be used in other architectures.

Answer

It is used for SHC members to find indexers.

Answer

It must be configured on every forwarder.

Answer

It replaces the load balancer.

Question 4

Which THREE of the following are reasons to use Maintenance Mode in an Indexer Cluster?

Accepted Answer

To modify cluster configuration settings.. Maintenance Mode in an Indexer Cluster is designed for controlled administrative operations that would otherwise trigger unnecessary bucket replication or search degradation. Option A is correct because modifying cluster configuration settings (such as replication_factor or search_factor) requires Maintenance Mode so the cluster does not immediately re-replicate or rebalance buckets while the change is being applied. Option B is correct because a rolling upgrade of the indexers is performed in Maintenance Mode to prevent the cluster from initiating re-replication each time a peer is taken down and brought back up during the upgrade. Option D is correct because Maintenance Mode suppresses the automatic re-replication of buckets when a peer restarts, avoiding wasted replication work and preserving cluster stability. Option C is not a valid reason, as clearing the cache of the Cluster Manager is not a Maintenance Mode function and is not a supported operational task in this context. Option E is incorrect because Maintenance Mode does not improve search performance; in fact, it can temporarily reduce search capabilities since primaries may be offline and searchable copies may be affected.

Answer

To clear the cache of the CM.

Answer

To speed up search performance.

Question 5

Which TWO of the following are necessary to configure a multi-site Indexer Cluster?

Accepted Answer

Define sites in server.conf.. Option A is correct because multi-site indexer clusters require site definitions in server.conf: each indexer and the cluster manager must declare their site (site0, site1, etc.) via the [general] stanza's site attribute, and the manager must also set multisite = true so the cluster operates in multi-site mode. Option D is correct because a multi-site cluster needs site-specific replication and search factors (e.g., site_replication_factor and site_search_factor in server.conf) so that copies of each bucket are distributed across sites according to the desired availability policy. Option B is not required, since a load balancer is optional and only used for distributing search or forwarding traffic, not a prerequisite for multi-site configuration. Option C is incorrect because the search factor is a cluster-wide setting configured on the manager, not something enabled individually on each indexer. Option E is incorrect because the license manager is a separate licensing concern and is not a requirement specific to configuring a multi-site indexer cluster.

Answer

Use a load balancer for all traffic.

Answer

Enable search factor on each indexer.

Answer

Configure the license master.

Question 6

A Splunk Enterprise deployment has a single-site Indexer Cluster with a replication factor of 3 and a search factor of 2. During a planned maintenance window, one indexer is taken offline. Shortly after, the cluster master reports that some buckets are in a degraded state. The site is configured with site_replication_factor = origin:2, total:3 and site_search_factor = origin:1, total:2. What is the most likely cause of the degraded state?

Accepted Answer

The site_replication_factor requires two copies at the origin site, and with one indexer offline, the origin site can no longer meet that requirement for some buckets.. In a multi-site indexer cluster, site_replication_factor and site_search_factor override the global replication and search factors. The origin site must maintain the specified number of copies. Taking an indexer offline reduces the available copies at that site, potentially violating the origin requirement and causing buckets to become non-compliant and marked as degraded. The global replication factor is still satisfied if enough copies exist, but the site-specific factor is stricter.

Answer

The cluster master cannot communicate with the offline indexer, causing it to mark all buckets on that indexer as degraded.

Answer

The search factor of 2 is violated because the offline indexer was the only searchable copy for some buckets.

Answer

The replication factor of 3 is no longer met because the offline indexer held one of the three copies, leaving only two copies cluster-wide.

Question 7

A Splunk Enterprise environment uses a Search Head Cluster with three members. The captain has been stable, but after a network partition, two members can communicate with each other but not with the third. The two members elect a new captain. When the partition heals, what happens to the original captain and the cluster?

Accepted Answer

The original captain detects the new captain and steps down, and the cluster continues with the new captain if it has a higher term.. Search Head Cluster captain election follows a Raft-like consensus protocol. When a network partition heals, the captain with the higher election term remains captain, and the other steps down. The new captain elected during the partition likely has a higher term, so the original captain becomes a peer. This automatic reconciliation prevents split-brain and maintains cluster consistency.

Answer

The cluster master forces a re-election, and the original captain is reinstated because it has the most recent configuration.

Answer

The original captain rejoins as a peer, and the newly elected captain remains captain because it has the higher term.

Answer

Both captains continue to operate independently, causing a split-brain scenario until an administrator manually intervenes.

Question 8

You are the Splunk architect for a large retail company. Your Indexer Cluster has a replication factor of 3 and a search factor of 2. A site-wide power failure causes two indexers in the same site to go offline simultaneously. The cluster manager reports that some buckets are now non-searchable. Which of the following best describes the cluster's immediate state and the appropriate recovery action?

Accepted Answer

The cluster is in a degraded state; you should wait for the indexers to come back online, as the cluster manager will automatically fix the replication and search factors.. With a replication factor of 3, losing two indexers leaves at least one copy of every bucket, so the cluster remains in a degraded state. The cluster manager automatically re-replicates and restores the search factor when peers return. No manual intervention is needed for a temporary outage.

Answer

The cluster is in a critical state; you must use the splunk CLI to manually set the replication factor to 1 to allow searches to continue.

Answer

The cluster is in a degraded state; you must manually copy bucket copies from remaining peers to a new indexer to restore the replication factor.

Answer

The cluster is in a critical state; you must immediately restart the cluster manager to trigger bucket replication.

Question 9

You are configuring a Search Head Cluster (SHC) for a customer that requires high availability and data consistency. Which two of the following statements are true regarding the role of the captain in an SHC? (Choose two.)

Accepted Answer

The captain is elected by a majority vote of the cluster members.. The captain replicates configuration changes to all members and is elected by a majority vote. These functions ensure consistent configuration and automatic failover, which are critical for high availability in a Search Head Cluster.

Answer

The captain must be manually configured on each member using the splunk edit shcluster-config command.

Answer

The captain is the only member that can run scheduled searches.

Answer

The captain automatically assumes the role of search head if a member fails.

Question 10

A Splunk architect is troubleshooting a distributed search environment where search heads are unable to communicate with indexers. The search heads are configured to use indexer discovery. Which of the following is the most likely cause of the communication failure?

Accepted Answer

The search heads are not configured with the correct cluster manager URI in server.conf.. Indexer discovery requires search heads to query the cluster manager for the list of indexers. If the cluster manager URI is misconfigured in server.conf on the search heads, they cannot retrieve the indexer list, causing communication failures.

Answer

The search heads are not configured with the correct search factor.

Answer

The indexer discovery master is not configured with the correct pass4SymmKey.

Answer

The indexers are not configured with the correct replication factor.

Question 11

In an Indexer Cluster, what is the primary role of the Cluster Master (CM) regarding bucket management?

Accepted Answer

Maintaining the bucket registry and managing replication status.. The Cluster Master (now called Cluster Manager in newer Splunk versions) maintains the bucket registry — the authoritative map of which buckets exist, their states (hot/warm/cold), and their replication status across peer indexers. It coordinates replication and searchability but does not index data or serve searches itself.

Answer

Directing search requests to specific indexers.

Answer

Indexing incoming forwarder data.

Answer

Storing raw data and serving search requests.

Answer

Aggregating search results from indexers.

Question 12

If an Indexer Cluster has a replication_factor of 3 and search_factor of 2, how many searchable copies of a bucket are maintained across the cluster?

Accepted Answer

2. In an Indexer Cluster, the search_factor defines how many searchable copies of each bucket are maintained across the cluster. With a search_factor of 2, exactly two searchable copies of each bucket exist. The replication_factor (3) determines the total number of copies (searchable plus non-searchable), but the search_factor specifically governs searchable copies.

Answer

5

Answer

4

Answer

1

Answer

3

Question 13

When using a Search Head Cluster, what is the purpose of the 'captain'?

Accepted Answer

To coordinate search scheduling and replicate configuration bundles.. The captain in a Search Head Cluster coordinates search scheduling and replicates configuration bundles across the cluster members, ensuring consistent search execution and configuration. This is why option E is correct.

Answer

To act as the Cluster Master for indexers.

Answer

To store all bucket data for the indexers.

Answer

To receive data from forwarders.

Answer

To distribute search results to the end user.

Question 14

What happens to a search job if the Search Head Cluster captain goes down during an active search?

Accepted Answer

A new captain is elected and search jobs are recovered.. In a Search Head Cluster, the captain is a dynamically elected member that coordinates configuration replication and search scheduling. If the captain goes down, a new captain is elected from the remaining members, and active search jobs are recovered and continue. This provides high availability and fault tolerance.

Answer

The search head cluster becomes read-only.

Answer

Indexers stop processing data.

Answer

The entire cluster must be restarted.

Answer

The search job is canceled immediately.

Question 15

You notice that your indexer cluster has 'Streaming' buckets that are not yet searchable. What is the most likely cause?

Accepted Answer

The search factor is not met for these buckets.. In an indexer cluster, a bucket transitions from 'streaming' to 'searchable' only after the search factor (SF) is satisfied — meaning the required number of searchable copies exist across peers. If SF is not met (e.g., a peer holding a searchable copy is down), the bucket remains in the streaming state and cannot be searched. This is the canonical cause of 'streaming buckets not yet searchable' in Splunk clustering.

Answer

The indexer is in maintenance mode.

Answer

The indexer disk is full.

Answer

The license is expired.

Answer

The Cluster Master is down.