March Special Limited Time 60% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 2493360325

Good News !!! SPLK-2002 Splunk Enterprise Certified Architect is now Stable and With Pass Result

SPLK-2002 Practice Exam Questions and Answers

Splunk Enterprise Certified Architect

Last Update 21 hours ago
Total Questions : 160

SPLK-2002 is stable now with all latest exam questions are added 21 hours ago. Just download our Full package and start your journey with Splunk Enterprise Certified Architect certification. All these Splunk SPLK-2002 practice exam questions are real and verified by our Experts in the related industry fields.

SPLK-2002 PDF

SPLK-2002 PDF (Printable)
$48
$119.99

SPLK-2002 Testing Engine

SPLK-2002 PDF (Printable)
$56
$139.99

SPLK-2002 PDF + Testing Engine

SPLK-2002 PDF (Printable)
$70.8
$176.99
Question # 1

In a distributed environment, knowledge object bundles are replicated from the search head to which location on the search peer(s)?

Options:

A.  

SPLUNK_HOME/var/lib/searchpeers

B.  

SPLUNK_HOME/var/log/searchpeers

C.  

SPLUNK_HOME/var/run/searchpeers

D.  

SPLUNK_HOME/var/spool/searchpeers

Discussion 0
Question # 2

When should multiple search pipelines be enabled?

Options:

A.  

Only if disk IOPS is at 800 or better.

B.  

Only if there are fewer than twelve concurrent users.

C.  

Only if running Splunk Enterprise version 6.6 or later.

D.  

Only if CPU and memory resources are significantly under-utilized.

Discussion 0
Question # 3

A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?

Options:

A.  

Configure syslog to send the data to multiple Splunk indexers.

B.  

Use a Splunk indexer to collect a network input on port 514 directly.

C.  

Use a Splunk forwarder to collect the input on port 514 and forward the data.

D.  

Configure syslog to write logs and use a Splunk forwarder to collect the logs.

Discussion 0
Question # 4

What is the default log size for Splunk internal logs?

Options:

A.  

10MB

B.  

20 MB

C.  

25MB

D.  

30MB

Discussion 0
Question # 5

Before users can use a KV store, an admin must create a collection. Where is a collection is defined?

Options:

A.  

kvstore.conf

B.  

collection.conf

C.  

collections.conf

D.  

kvcollections.conf

Discussion 0
Question # 6

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

Options:

A.  

Two indexers not in a cluster, assuming users run many long searches.

B.  

Three indexers not in a cluster, assuming a long data retention period.

C.  

Two indexers clustered, assuming high availability is the greatest priority.

D.  

Two indexers clustered, assuming a high volume of saved/scheduled searches.

Discussion 0
Question # 7

What is the logical first step when starting a deployment plan?

Options:

A.  

Inventory the currently deployed logging infrastructure.

B.  

Determine what apps and use cases will be implemented.

C.  

Gather statistics on the expected adoption of Splunk for sizing.

D.  

Collect the initial requirements for the deployment from all stakeholders.

Discussion 0
Question # 8

Which of the following is a good practice for a search head cluster deployer?

Options:

A.  

The deployer only distributes configurations to search head cluster members when they “phone home”.

B.  

The deployer must be used to distribute non-replicable configurations to search head cluster members.

C.  

The deployer must distribute configurations to search head cluster members to be valid configurations.

D.  

The deployer only distributes configurations to search head cluster members with splunk apply shcluster-bundle.

Discussion 0
Question # 9

A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?

Options:

A.  

Create a job server on the cluster.

B.  

Add another search head to the cluster.

C.  

server.conf captain_is_adhoc_searchhead = true.

D.  

Change limits.conf value for max_searches_per_cpu to a higher value.

Discussion 0
Question # 10

What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

Options:

A.  

Disables search site affinity.

B.  

Sets all members to dynamic captaincy.

C.  

Enables multisite search artifact replication.

D.  

Enables automatic search site affinity discovery.

Discussion 0
Question # 11

Which of the following should be included in a deployment plan?

Options:

A.  

Business continuity and disaster recovery plans.

B.  

Current logging details and data source inventory.

C.  

Current and future topology diagrams of the IT environment.

D.  

A comprehensive list of stakeholders, either direct or indirect.

Discussion 0
Question # 12

Which CLI command converts a Splunk instance to a license slave?

Options:

A.  

splunk add licenses

B.  

splunk list licenser-slaves

C.  

splunk edit licenser-localslave

D.  

splunk list licenser-localslave

Discussion 0
Question # 13

Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?

Options:

A.  

Data encryption between Splunk Web and splunkd.

B.  

Certificate authentication between forwarders and indexers.

C.  

Certificate authentication between Splunk Web and search head.

D.  

Data encryption for distributed search between search heads and indexers.

Discussion 0
Get SPLK-2002 dumps and pass your exam in 24 hours!

Free Exams Sample Questions