CCNA High Availability And Distributed Search Questions

MCQmedium

When adding a new indexer to an existing Indexer Cluster, what is the best practice to ensure the indexer is ready before it starts receiving data?

A.Start the splunk service and wait for the CM to acknowledge registration.

B.Set the indexer to maintenance mode.

C.Manually copy index buckets from other peers.

D.Restart all existing peers.

E.Add the indexer to the indexer discovery list.

AnswerA

The peer must complete the handshake with the CM to be active.

Why this answer

New peers must register with the Cluster Master and receive the latest configuration bundle before they can participate in indexing.

Practice this question →

MCQeasy

Which component is responsible for distributing configuration bundles to indexers in a cluster?

A.Deployment Server

B.Cluster Master

C.License Master

D.Indexer Peer

E.Search Head

AnswerB

The CM is the single source of truth for indexer configuration.

Why this answer

The Cluster Master manages the configuration bundles and pushes them to indexer peers upon configuration changes.

Practice this question →

Multi-Selectmedium

Which TWO of the following are necessary to configure a multi-site Indexer Cluster?

Select 2 answers

A.Define sites in server.conf.

B.Use a load balancer for all traffic.

C.Enable search factor on each indexer.

D.Define site-specific replication factors.

E.Configure the license master.

AnswersA, D

Required for site awareness.

Why this answer

Multi-site clusters require explicit definition of sites in server.conf and appropriate replication factor settings for those sites.

Practice this question →

Multi-Selecthard

Which TWO of the following are true about the 'splunk apply shcluster-bundle' command?

Select 2 answers

A.It distributes configuration bundles to all members.

B.It is used for indexer cluster management.

C.It can be run from any SHC member.

D.It requires member restart to apply changes.

E.It requires the '--skip-version-check' flag.

AnswersA, D

This is the primary function of the command.

Why this answer

This command pushes configurations from the captain to all members and requires a restart or reload of the splunkd service.

Practice this question →

MCQmedium

In a disaster recovery scenario, which file must be restored to a new Cluster Master to ensure it recognizes the existing indexer peers?

A.inputs.conf

B.server.conf

C.distsearch.conf

D.props.conf

E.indexes.conf

AnswerB

The cluster secret and mode are stored here.

Why this answer

The 'server.conf' (containing the cluster secret and configuration) and the 'master-apps' directory are crucial for restoring a CM's knowledge of the cluster.

Practice this question →

MCQeasy

What is the recommended method to distribute configuration changes across a Search Head Cluster?

A.Using the Deployment Server.

B.Updating the captain only.

C.Using the 'splunk apply shcluster-bundle' command.

D.Manual file copying to each node.

E.Using a shared network drive.

AnswerC

This ensures atomic and consistent updates across all members.

Why this answer

The 'splunk apply shcluster-bundle' command is the only supported method for pushing configuration updates to SHC members.

Practice this question →

Multi-Selecteasy

Which THREE of the following are components involved in a distributed search architecture?

Select 3 answers

A.Deployment Server

B.Search Head

C.Application Server

D.Indexer

E.Database Server

AnswersA, B, D

Essential for management.

Why this answer

A distributed architecture requires a search head for queries, indexers for data, and a deployment server for configuration management.

Practice this question →

MCQeasy

In an Indexer Cluster, what is the primary role of the Cluster Master (CM) regarding bucket management?

A.Directing search requests to specific indexers.

B.Indexing incoming forwarder data.

C.Maintaining the bucket registry and managing replication status.

D.Storing raw data and serving search requests.

E.Aggregating search results from indexers.

AnswerC

The CM maintains the state of the cluster and delegates replication tasks.

Why this answer

The CM assigns bucket IDs and manages bucket replication/searchability across peers, but it does not store the raw indexed data itself.

Practice this question →

Multi-Selecthard

Which THREE of the following are risks if the replication_factor is too low?

Select 3 answers

A.Slower indexing speed.

B.Data loss if an indexer fails.

C.Inability to meet search factor requirements.

D.Increased downtime during peer maintenance.

E.Higher CPU usage on the CM.

AnswersB, C, D

Fewer copies mean higher risk.

Why this answer

Low replication factor reduces data redundancy, increases the chance of data loss during failure, and may lead to search gaps.

Practice this question →

Multi-Selectmedium

Which TWO of the following are features of the Indexer Cluster Master?

Select 2 answers

A.Performing data parsing.

B.Managing bucket replication.

C.Authenticating users.

D.Monitoring indexer health.

E.Routing search results to users.

AnswersB, D

The CM ensures data redundancy.

Why this answer

The CM monitors the health of indexers and manages bucket replication status.

Practice this question →

MCQmedium

If an Indexer Cluster is configured with site-based replication, where should the 'site' attribute be defined?

A.On the license master.

B.In the inputs.conf on the forwarders.

C.On the Cluster Master only.

D.In the indexer's server.conf.

E.In the search head cluster settings.

AnswerD

The indexer communicates its site identity at registration.

Why this answer

The 'site' attribute must be defined in the 'server.conf' file on every indexer peer, identifying which site the peer belongs to.

Practice this question →

Multi-Selecteasy

Which THREE of the following are key components of a disaster recovery plan for Splunk?

Select 3 answers

A.Off-site storage of frozen buckets.

B.Regular backup of the etc/ directory.

C.Increasing the replication factor.

D.Documented restoration procedures.

E.Continuous indexing of all data.

AnswersA, B, D

Essential for data recovery.

Why this answer

Disaster recovery involves backing up critical configs, maintaining off-site copies of data, and having a restoration procedure.

Practice this question →

MCQhard

In a multisite cluster, how does the 'site_replication_factor' override the global 'replication_factor'?

A.It only applies to the primary site.

B.It ignores the search factor.

C.It is used for load balancing.

D.It is only used when the CM is down.

E.It defines the total number of copies per site.

AnswerE

Site-specific settings explicitly dictate the bucket counts for that site.

Why this answer

The site-specific definition takes precedence over the global default to ensure specific data distribution requirements for each site are met.

Practice this question →

MCQeasy

What is the primary function of the 'Cluster Secret' in a Splunk Indexer Cluster?

A.To secure the communication between cluster nodes.

B.To define the replication factor.

C.To authorize search head access.

D.To manage indexer licensing.

E.To encrypt data in flight.

AnswerA

The secret validates that nodes belong to the same secure cluster.

Why this answer

The secret acts as a shared password to ensure that only authorized peers can join the cluster and communicate with the Cluster Master.

Practice this question →

Multi-Selecteasy

Which TWO of the following are valid ways to monitor the status of an Indexer Cluster?

Select 2 answers

A.Checking the license usage logs.

B.Using the CLI command 'splunk show cluster-status'.

C.Using the Monitoring Console.

D.Reviewing the forwarder logs.

E.Running a search on the indexers directly.

AnswersB, C

Standard CLI method.

Why this answer

You can use the CLI 'show cluster-status' command or the monitoring console UI.

Practice this question →

Multi-Selecthard

Which TWO of the following are true about Indexer Discovery?

Select 2 answers

A.It is used for SHC members to find indexers.

B.It must be configured on every forwarder.

C.It dynamically provides a list of indexers to forwarders.

D.It replaces the load balancer.

E.It requires the indexers to be in an Indexer Cluster.

AnswersC, E

The CM provides the list.

Why this answer

Indexer discovery simplifies management by allowing forwarders to dynamically find indexers without manual config updates.

Practice this question →

MCQhard

If an Indexer Cluster has a replication_factor of 3 and search_factor of 2, how many searchable copies of a bucket are maintained across the cluster?

A.5

B.2

C.4

D.1

E.3

AnswerB

The search factor dictates the count of searchable bucket copies.

Why this answer

The search factor determines how many copies of a bucket are searchable. If search_factor is 2, the cluster ensures at least two copies are available for searching.

Practice this question →

MCQmedium

When configuring a Search Head Cluster, which of the following is true regarding the 'shcluster_replication_port'?

A.It must be different for every member.

B.It is only used by the captain.

C.It is used for forwarding data.

D.It is automatically detected by the Cluster Master.

E.It must be configured in server.conf.

AnswerE

The replication port is specified in the [shclustering] stanza of server.conf.

Why this answer

The replication port is used by SHC members to sync configuration changes, job results, and knowledge objects, and must be open on all members.

Practice this question →

Multi-Selectmedium

Which THREE of the following are common causes for a Search Head Cluster member to lose contact with the captain?

Select 3 answers

A.Service load is too high causing timeouts.

B.License master is offline.

C.The indexer cluster is busy.

D.Network instability.

E.Replication port is blocked by firewall.

AnswersA, D, E

Delays response.

Why this answer

Loss of contact is often due to network issues, replication port blockage, or excessive load causing timeout.

Practice this question →

MCQmedium

What is the recommended way to handle an indexer peer that is permanently failing in an Indexer Cluster?

A.Ignore the peer and wait for timeout.

B.Delete the indexer's data directory manually.

C.Update the master node configuration.

D.Shutdown the service without notice.

E.Use the 'splunk offline' command on the peer.

AnswerE

This notifies the CM to begin re-replication of the buckets assigned to that peer.

Why this answer

You should use the 'splunk offline' command to gracefully remove the peer, allowing the cluster to re-replicate the missing data to other healthy peers.

Practice this question →

MCQmedium

You are designing a multi-site Indexer Cluster with two sites. To ensure search availability during a site failure, which configuration is mandatory in the site_replication_factor stanza of server.conf?

A.Enable search_factor to 2 for all sites.

B.Set replication_factor to 1 on each site.

C.Define explicit replication counts for each site using 'siteN' syntax.

D.Set cluster_mode to 'multisite_master'.

E.Configure the indexer as a site-local peer.

AnswerC

Multi-site clusters require explicit site-based replication factor definitions.

Why this answer

In a multi-site cluster, the total replication factor must be the sum of site-specific replication factors, and each site must be explicitly defined to ensure data is distributed across sites.

Practice this question →

MCQmedium

When a Search Head Cluster is running in a multi-site environment, what configuration ensures search results are optimized?

A.Index-level bucket settings.

B.Disabling search head replication.

C.Site-specific replication factor.

D.Search affinity settings in server.conf.

E.Increasing the search timeout.

AnswerD

Defining the site on the SHC members is key for affinity.

Why this answer

Configuring 'site' in server.conf on each SHC member allows the cluster to use search affinity to query the nearest indexers.

Practice this question →

MCQeasy

Which command is used to check the health of an Indexer Cluster from the Cluster Master CLI?

A.splunk cluster-check

B.splunk show cluster-status

C.splunk inspect-cluster

D.splunk search-peers

E.splunk list indexers

AnswerB

This is the standard command for status monitoring.

Why this answer

The 'splunk show cluster-status' command provides a summary of peer health, bucket status, and replication metrics.

Practice this question →

MCQhard

A customer is experiencing 'Search peer [peer-name] is not responding' errors during indexer maintenance. Which configuration parameter in server.conf should be tuned to prevent search failures during rolling restarts?

A.peer_down_timeout

B.max_search_time

C.restart_timeout

D.heartbeat_timeout

E.search_retry_timeout

AnswerC

This allows for longer wait times during planned maintenance.

Why this answer

The 'restart_timeout' parameter in the [clustering] stanza controls how long a search head waits for a peer to return before marking it as down during a rolling restart.

Practice this question →

MCQmedium

You need to migrate a single-site Indexer Cluster to a multi-site configuration. What is the first step you must perform before modifying the server.conf on the Cluster Master?

A.Delete all existing buckets.

B.Set the cluster to maintenance_mode=true.

C.Configure the site-specific replication factors.

D.Upgrade the license server.

E.Disable all forwarder data ingestion.

AnswerB

Maintenance mode prevents unnecessary bucket transfers during configuration changes.

Why this answer

You must put the cluster into maintenance mode to prevent the CM from attempting to rebalance buckets or trigger replication while you are actively reconfiguring the site topology.

Practice this question →

MCQhard

You notice that your indexer cluster has 'Streaming' buckets that are not yet searchable. What is the most likely cause?

A.The indexer is in maintenance mode.

B.The indexer disk is full.

C.The license is expired.

D.The search factor is not met for these buckets.

E.The Cluster Master is down.

AnswerD

Buckets only become searchable once the required number of search-factor copies are confirmed.

Why this answer

Streaming buckets are warm/cold buckets that are currently being replicated; if they aren't searchable, it indicates the search factor has not yet been satisfied for those buckets.

Practice this question →

MCQhard

You are investigating a search issue where results are inconsistent across SHC members. What is a possible cause?

A.Different indexes.conf versions on SHC members.

B.Indexer peers are in maintenance mode.

C.The forwarder is sending bad data.

D.The license master is unreachable.

E.The Cluster Master is too busy.

AnswerA

Inconsistent configurations lead to inconsistent search results.

Why this answer

If the replication service is failing or the configuration bundles are out of sync, search results may differ between nodes.

Practice this question →

MCQeasy

Which component in a distributed search environment is responsible for the 'Search Affinity' feature?

A.Search Head

B.Deployment Server

C.License Master

D.Indexer Peer

E.Cluster Master

AnswerA

The Search Head uses the site information to determine which indexers to query.

Why this answer

Search affinity allows a Search Head to prefer indexers within the same site, reducing cross-site bandwidth usage.

Practice this question →

MCQmedium

When using a Search Head Cluster, what is the purpose of the 'captain'?

A.To act as the Cluster Master for indexers.

B.To store all bucket data for the indexers.

C.To receive data from forwarders.

D.To distribute search results to the end user.

E.To coordinate search scheduling and replicate configuration bundles.

AnswerE

The captain is the elected leader responsible for cluster management tasks.

Why this answer

The captain manages the search head cluster's configuration, coordinates job scheduling, and maintains the cluster state.

Practice this question →

MCQeasy

Which type of bucket is used for the most recent data and is generally searchable?

A.Warm

B.Cold

C.Frozen

D.Thawed

E.Hot

AnswerE

Hot buckets are active and searchable.

Why this answer

Hot buckets are where data is currently being ingested and they are always searchable.

Practice this question →

MCQeasy

Which feature ensures that Search Head Cluster members share knowledge objects like saved searches and reports?

A.Cluster Master

B.Index-time extraction

C.Search Head Cluster replication

D.Bucket replication

E.Deployment Server

AnswerC

SHC members replicate knowledge objects via their internal replication service.

Why this answer

Search Head Cluster members synchronize knowledge objects automatically using the replication service configured on the replication port.

Practice this question →

MCQhard

What happens to a search job if the Search Head Cluster captain goes down during an active search?

A.The search head cluster becomes read-only.

B.Indexers stop processing data.

C.A new captain is elected and search jobs are recovered.

D.The entire cluster must be restarted.

E.The search job is canceled immediately.

AnswerC

The RAFT algorithm handles captain election and job recovery.

Why this answer

The cluster will elect a new captain, and the search job will typically resume or be re-dispatched by the new captain depending on the state of the job.

Practice this question →

MCQmedium

What is the effect of setting 'forwarder_site_failover=true' in the indexer discovery stanza?

A.It mandates the use of SSL.

B.It increases the replication factor.

C.Forwarders will stop sending data if the local site is down.

D.Forwarders can failover to indexers in another site.

E.The indexer discovery service is disabled.

AnswerD

This enables cross-site data ingestion during failure.

Why this answer

This setting allows forwarders to automatically switch to indexers in a different site if the local indexers are unavailable.

Practice this question →

Multi-Selectmedium

Which THREE of the following are valid states for a bucket in an Indexer Cluster?

Select 3 answers

A.Cold

B.Hot

C.Warm

D.Active

E.Pending

AnswersA, B, C

Buckets roll to cold.

Why this answer

Buckets transition through hot, warm, and cold states during their lifecycle in an indexer cluster.

Practice this question →

Multi-Selecthard

Which THREE of the following are reasons to use Maintenance Mode in an Indexer Cluster?

Select 3 answers

A.To modify cluster configuration settings.

B.To perform a rolling upgrade of the indexers.

C.To clear the cache of the CM.

D.To prevent re-replication during a peer restart.

E.To speed up search performance.

AnswersA, B, D

Prevents the CM from acting on temporary state changes.

Why this answer

Maintenance mode is used for rolling upgrades, changing cluster configurations, and preventing unnecessary bucket re-replication during planned outages.

Practice this question →

Multi-Selecteasy

Which TWO of the following are prerequisites for a functional Search Head Cluster?

Select 2 answers

A.A shared network file system.

B.A dedicated license master.

C.A Cluster Master node.

D.Open replication port between all members.

E.Identical security keys on all members.

AnswersD, E

Replication requires network connectivity.

Why this answer

SHC nodes must be able to communicate via the replication port, and they must share the same security keys.

Practice this question →

MCQhard

When using a load balancer in front of a search head cluster, why is session affinity (sticky sessions) recommended?

A.To increase the replication speed.

B.To prevent unauthorized access.

C.To improve indexing performance.

D.To maintain session persistence and search job state.

E.To reduce the number of license tokens.

AnswerD

SHC members have local state for search jobs; jumping between them causes issues.

Why this answer

Sticky sessions ensure that a user remains connected to the same SHC member, preventing issues with search job state and UI session consistency.

Practice this question →

MCQhard

You want to perform a rolling restart of an Indexer Cluster without stopping ingestion. What configuration ensures that indexers remain available?

A.Set 'restart_mode=rolling'.

B.Disable the indexer peers.

C.Stop the Cluster Master first.

D.Restart all indexers at once.

E.Set 'replication_factor=1'.

AnswerA

Rolling restart allows the cluster to restart peers one by one.

Why this answer

The rolling restart mechanism automatically manages peer availability, but you should also ensure your forwarders are configured with indexing-side load balancing.

Practice this question →

MCQhard

When configuring search affinity for a multi-site cluster, what is the behavior if no indexers are available in the local site?

A.The search fails immediately.

B.The search head queries indexers in other sites.

C.The search head waits for the local indexer to return.

D.The search head only returns partial results.

E.The search head reports an error to the user.

AnswerB

Cross-site search is the standard fallback behavior.

Why this answer

By default, the search head will fallback to searching indexers in other sites if the local site is unavailable, ensuring search results are still retrieved.

Practice this question →