SPLK-2002 High Availability And Distributed Search Practice Test 2 — 15 Questions

Question 1

What is the recommended way to handle an indexer peer that is permanently failing in an Indexer Cluster?

Accepted Answer

Use the 'splunk offline' command on the peer.. You should use the 'splunk offline' command to gracefully remove the peer, allowing the cluster to re-replicate the missing data to other healthy peers.

Answer

Ignore the peer and wait for timeout.

Answer

Delete the indexer's data directory manually.

Answer

Update the master node configuration.

Answer

Shutdown the service without notice.

Question 2

Which feature ensures that Search Head Cluster members share knowledge objects like saved searches and reports?

Accepted Answer

Search Head Cluster replication. Search Head Cluster members synchronize knowledge objects automatically using the replication service configured on the replication port.

Answer

Cluster Master

Answer

Index-time extraction

Answer

Bucket replication

Answer

Deployment Server

Question 3

You want to perform a rolling restart of an Indexer Cluster without stopping ingestion. What configuration ensures that indexers remain available?

Accepted Answer

Set 'restart_mode=rolling'.. The rolling restart mechanism automatically manages peer availability, but you should also ensure your forwarders are configured with indexing-side load balancing.

Answer

Disable the indexer peers.

Answer

Stop the Cluster Master first.

Answer

Restart all indexers at once.

Answer

Set 'replication_factor=1'.

Question 4

When adding a new indexer to an existing Indexer Cluster, what is the best practice to ensure the indexer is ready before it starts receiving data?

Accepted Answer

Start the splunk service and wait for the CM to acknowledge registration.. New peers must register with the Cluster Master and receive the latest configuration bundle before they can participate in indexing.

Answer

Set the indexer to maintenance mode.

Answer

Manually copy index buckets from other peers.

Answer

Restart all existing peers.

Answer

Add the indexer to the indexer discovery list.

Question 5

Which type of bucket is used for the most recent data and is generally searchable?

Accepted Answer

Hot. Hot buckets are where data is currently being ingested and they are always searchable.

Answer

Warm

Answer

Cold

Answer

Frozen

Answer

Thawed

Question 6

In a multisite cluster, how does the 'site_replication_factor' override the global 'replication_factor'?

Accepted Answer

It defines the total number of copies per site.. The site-specific definition takes precedence over the global default to ensure specific data distribution requirements for each site are met.

Answer

It only applies to the primary site.

Answer

It ignores the search factor.

Answer

It is used for load balancing.

Answer

It is only used when the CM is down.

Question 7

Which component is responsible for distributing configuration bundles to indexers in a cluster?

Accepted Answer

Cluster Master. The Cluster Master manages the configuration bundles and pushes them to indexer peers upon configuration changes.

Answer

Deployment Server

Answer

License Master

Answer

Indexer Peer

Answer

Search Head

Question 8

What is the effect of setting 'forwarder_site_failover=true' in the indexer discovery stanza?

Accepted Answer

Forwarders can failover to indexers in another site.. This setting allows forwarders to automatically switch to indexers in a different site if the local indexers are unavailable.

Answer

It mandates the use of SSL.

Answer

It increases the replication factor.

Answer

Forwarders will stop sending data if the local site is down.

Answer

The indexer discovery service is disabled.

Question 9

If an Indexer Cluster is configured with site-based replication, where should the 'site' attribute be defined?

Accepted Answer

In the indexer's server.conf.. The 'site' attribute must be defined in the 'server.conf' file on every indexer peer, identifying which site the peer belongs to.

Answer

On the license master.

Answer

In the inputs.conf on the forwarders.

Answer

On the Cluster Master only.

Answer

In the search head cluster settings.

Question 10

Which THREE of the following are valid states for a bucket in an Indexer Cluster?

Accepted Answer

Cold. Buckets transition through hot, warm, and cold states during their lifecycle in an indexer cluster.

Answer

Active

Answer

Pending

Question 11

When using a load balancer in front of a search head cluster, why is session affinity (sticky sessions) recommended?

Accepted Answer

To maintain session persistence and search job state.. Sticky sessions ensure that a user remains connected to the same SHC member, preventing issues with search job state and UI session consistency.

Answer

To increase the replication speed.

Answer

To prevent unauthorized access.

Answer

To improve indexing performance.

Answer

To reduce the number of license tokens.

Question 12

What is the primary function of the 'Cluster Secret' in a Splunk Indexer Cluster?

Accepted Answer

To secure the communication between cluster nodes.. The secret acts as a shared password to ensure that only authorized peers can join the cluster and communicate with the Cluster Master.

Answer

To define the replication factor.

Answer

To authorize search head access.

Answer

To manage indexer licensing.

Answer

To encrypt data in flight.

Question 13

When a Search Head Cluster is running in a multi-site environment, what configuration ensures search results are optimized?

Accepted Answer

Search affinity settings in server.conf.. Configuring 'site' in server.conf on each SHC member allows the cluster to use search affinity to query the nearest indexers.

Answer

Index-level bucket settings.

Answer

Disabling search head replication.

Answer

Site-specific replication factor.

Answer

Increasing the search timeout.

Question 14

Which TWO of the following are prerequisites for a functional Search Head Cluster?

Accepted Answer

Open replication port between all members.. SHC nodes must be able to communicate via the replication port, and they must share the same security keys.

Answer

A shared network file system.

Answer

A dedicated license master.

Answer

A Cluster Master node.

Question 15

You are investigating a search issue where results are inconsistent across SHC members. What is a possible cause?

Accepted Answer

Different indexes.conf versions on SHC members.. If the replication service is failing or the configuration bundles are out of sync, search results may differ between nodes.

Answer

Indexer peers are in maintenance mode.

Answer

The forwarder is sending bad data.

Answer

The license master is unreachable.

Answer

The Cluster Master is too busy.