Pass4sure offers free demo for SPLK-2002 exam. "Splunk Enterprise Certified Architect", also known as SPLK-2002 exam, is a Splunk Certification. This set of posts, Passing the Splunk SPLK-2002 exam, will help you answer those questions. The SPLK-2002 Questions & Answers covers all the knowledge points of the real exam. 100% real Splunk SPLK-2002 exams and revised by experts!
Check SPLK-2002 free dumps before getting the full version:
NEW QUESTION 1
In the deployment planning process, when should a person identify who gets to see network data?
- A. Deployment schedule
- B. Topology diagramming
- C. Data source inventory
- D. Data policy definition
Answer: C
NEW QUESTION 2
Which of the following options can improve reliability of syslog delivery to Splunk? (Select all that apply.)
- A. Use TCP syslog.
- B. Configure UDP inputs on each Splunk indexer to receive data directly.
- C. Use a network load balancer to direct syslog traffic to active backend syslog listeners.
- D. Use one or more syslog servers to persist data with a Universal Forwarder to send the data to Splunk indexers.
Answer: CD
NEW QUESTION 3
A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining that the events are inconsistently formatted for a web sourcetype. Further investigation reveals that not all web logs flow through the same infrastructure: some of the data goes through heavy forwarders and some of the forwarders are managed by another department. Which of the following items might be the cause for this issue?
- A. The search head may have different configurations than the indexers.
- B. The data inputs are not properly configured across all the forwarders.
- C. The indexers may have different configurations than the heavy forwarders.
- D. The forwarders managed by the other department are an older version than the rest.
Answer: D
NEW QUESTION 4
Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?
- A. Setting the cluster search factor to N-1.
- B. Increasing the number of buckets per index.
- C. Decreasing the data model acceleration range.
- D. Setting the cluster replication factor to N-1.
Answer: D
NEW QUESTION 5
When Splunk is installed, where are the internal indexes
stored by default?
- A. SPLUNK_HOME/bin
- B. SPLUNK_HOME/var/lib
- C. SPLUNK_HOME/var/run
- D. SPLUNK_HOME/etc/system/default
Answer: B
NEW QUESTION 6
Which search head cluster component is responsible for pushing knowledge bundles to search peers, replicating configuration changes to search head cluster members, and scheduling jobs across the search head cluster?
- A. Master
- B. Captain
- C. Deployer
- D. Deployment server
Answer: B
NEW QUESTION 7
Which index-time props.conf attributes impact indexing performance? (Select all that apply.)
- A. REPORT
- B. LINE_BREAKER
- C. ANNOTATE_PUNCT
- D. SHOULD_LINEMERGE
Answer: BD
NEW QUESTION 8
What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)
- A. Distributes apps to SHC members.
- B. Bootstraps a clean Splunk install for a SHC.
- C. Distributes non-search related and manual configuration file changes.
- D. Distributes runtime knowledge object changes made by users across the SHC.
Answer: A
NEW QUESTION 9
How does the average run time of all searches relate to the available CPU cores on the indexers?
- A. Average run time is independent of the number of CPU cores on the indexers.
- B. Average run time decreases as the number of CPU cores on the indexers decreases.
- C. Average run time increases as the number of CPU cores on the indexers decreases.
- D. Average run time increases as the number of CPU cores on the indexers increases.
Answer: C
NEW QUESTION 10
Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?
- A. Data encryption between Splunk Web and splunkd.
- B. Certificate authentication between forwarders and indexers.
- C. Certificate authentication between Splunk Web and search head.
- D. Data encryption for distributed search between search heads and indexers.
Answer: B
NEW QUESTION 11
Of the following types of files within an index bucket, which file type may consume the most disk?
- A. Rawdata
- B. Bloom filter
- C. Metadata (.data)
- D. Inverted index (.tsidx)
Answer: B
NEW QUESTION 12
When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?
- A. Auto
- B. None
- C. True
- D. False
Answer: C
NEW QUESTION 13
Which of the following artifacts are included in a Splunk diag file? (Select all that apply.)
- A. OS settings.
- B. Internal logs.
- C. Customer data.
- D. Configuration files.
Answer: BD
NEW QUESTION 14
A Splunk user successfully extracted an ip address into a field called src_ip. Their colleague cannot see that field in their search results with events known to have src_ip. Which of the following may explain the problem? (Select all that apply.)
- A. The field was extracted as a private knowledge object.
- B. The events are tagged as communicate, but are missing the network tag.
- C. The Typing Queue, which does regular expression replacements, is blocked.
- D. The colleague did not explicitly use the field in the search and the search was set to Fast Mode.
Answer: D
NEW QUESTION 15
The KV store forms its own cluster within a SHC. What is the maximum number of SHC members KV
store will form?
- A. 25
- B. 50
- C. 100
- D. Unlimited
Answer: D
NEW QUESTION 16
A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)
- A. Via Splunk Web.
- B. Directly edit SPLUNK_HOME/etc/system/local/server.conf
- C. Run a splunk edit cluster-config command from the CLI.
- D. Directly edit SPLUNK_HOME/etc/system/default/server.conf
Answer: AB
NEW QUESTION 17
What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?
- A. btool.log
- B. metrics.log
- C. splunkd.log
- D. tailing_processor.log
Answer: C
NEW QUESTION 18
Which of the following are client filters available in serverclass.conf? (Select all that apply.)
- A. DNS name.
- B. IP address.
- C. Splunk server role.
- D. Platform (machine type).
Answer: AB
NEW QUESTION 19
Which of the following is a good practice for a search head cluster deployer?
- A. The deployer only distributes configurations to search head cluster members when they “phone home”.
- B. The deployer must be used to distribute non-replicable configurations to search head cluster members.
- C. The deployer must distribute configurations to search head cluster members to be valid configurations.
- D. The deployer only distributes configurations to search head cluster members with splunk apply shcluster-bundle.
Answer: A
NEW QUESTION 20
To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?
- A. adhoc_searchhead = true (on all members)
- B. adhoc_searchhead = true (on the current captain)
- C. captain_is_adhoc_searchhead = true (on all members)
- D. captain_is_adhoc_searchhead = true (on the current captain)
Answer: D
NEW QUESTION 21
A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?
- A. Configure syslog to send the data to multiple Splunk indexers.
- B. Use a Splunk indexer to collect a network input on port 514 directly.
- C. Use a Splunk forwarder to collect the input on port 514 and forward the data.
- D. Configure syslog to write logs and use a Splunk forwarder to collect the logs.
Answer: C
NEW QUESTION 22
What is the minimum reference server specification for a Splunk indexer?
- A. 12 CPU cores, 12GB RAM, 800 IOPS
- B. 16 CPU cores, 16GB RAM, 800 IOPS
- C. 24 CPU cores, 16GB RAM, 1200 IOPS
- D. 28 CPU cores, 32GB RAM, 1200 IOPS
Answer: A
NEW QUESTION 23
Which component in the splunkd.log will log information related to bad event breaking?
- A. Audittrail
- B. EventBreaking
- C. IndexingPipeline
- D. AggregatorMiningProcessor
Answer: D
NEW QUESTION 24
Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?
- A. System local directory.
- B. System default directory.
- C. App local directories, in ASCII order.
- D. App default directories, in ASCII order.
Answer: A
NEW QUESTION 25
......
P.S. Easily pass SPLK-2002 Exam with 90 Q&As prep-labs.com Dumps & pdf Version, Welcome to Download the Newest prep-labs.com SPLK-2002 Dumps: https://www.prep-labs.com/dumps/SPLK-2002/ (90 New Questions)