Halloween Sale Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: merry71

Free Splunk Enterprise Certified Architect Practice Questions

Question # 21

Which of the following is a problem that could be investigated using the Search Job Inspector?

Options:

A.  

Error messages are appearing underneath the search bar in Splunk Web.

B.  

Dashboard panels are showing "Waiting for queued job to start" on page load.

C.  

Different users are seeing different extracted fields from the same search.

D.  

Events are not being sorted in reverse chronological order.

Discussion 0
Question # 22

Which of the following most improves KV Store resiliency?

Options:

A.  

Decrease latency between search heads.

B.  

Add faster storage to the search heads to improve artifact replication.

C.  

Add indexer CPU and memory to decrease search latency.

D.  

Increase the size of the Operations Log.

Discussion 0
Question # 23

Which of the following strongly impacts storage sizing requirements for Enterprise Security?

Options:

A.  

The number of scheduled (correlation) searches.

B.  

The number of Splunk users configured.

C.  

The number of source types used in the environment.

D.  

The number of Data Models accelerated.

Discussion 0
Question # 24

(Which command is used to initially add a search head to a single-site indexer cluster?)

Options:

A.  

splunk edit cluster-config -mode searchhead -manager_uri https://10.0.0.1:8089 -secret changeme

B.  

splunk edit cluster-config -mode peer -manager_uri https://10.0.0.1:8089 -secret changeme

C.  

splunk add cluster-manager -manager_uri https://10.0.0.1:8089 -secret changeme

D.  

splunk add cluster-manager -mode searchhead -manager_uri https://10.0.0.1:8089 -secret changeme

Discussion 0
Question # 25

Which of the following is an indexer clustering requirement?

Options:

A.  

Must use shared storage.

B.  

Must reside on a dedicated rack.

C.  

Must have at least three members.

D.  

Must share the same license pool.

Discussion 0
Question # 26

Which command is used for thawing the archive bucket?

Options:

A.  

Splunk collect

B.  

Splunk convert

C.  

Splunk rebuild

D.  

Splunk dbinspect

Discussion 0
Question # 27

Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

Options:

A.  

High performance SAN should never be used.

B.  

Enable NFS for storing hot and warm buckets.

C.  

The recommended RAID setup is RAID 10 (1 + 0).

D.  

Virtualized environments are usually preferred over bare metal for Splunk indexers.

Discussion 0
Question # 28

(It is possible to lose UI edit functionality after manually editing which of the following files in the deployment server?)

Options:

A.  

serverclass.conf

B.  

deploymentclient.conf

C.  

inputs.conf

D.  

deploymentserver.conf

Discussion 0
Question # 29

Which of the following is a valid use case that a search head cluster addresses?

Options:

A.  

Provide redundancy in the event a search peer fails.

B.  

Search affinity.

C.  

Knowledge Object replication.

D.  

Increased Search Factor (SF).

Discussion 0
Question # 30

Splunk Enterprise performs a cyclic redundancy check (CRC) against the first and last bytes to prevent the same file from being re-indexed if it is rotated or renamed. What is the number of bytes sampled by default?

Options:

A.  

128

B.  

512

C.  

256

D.  

64

Discussion 0

SPLK-2002 PDF

SPLK-2002 PDF (Printable)
$46.5
$154.99

SPLK-2002 Testing Engine

SPLK-2002 PDF (Printable)
$51
$169.99

SPLK-2002 PDF + Testing Engine

SPLK-2002 PDF (Printable)
$63.9
$212.99

Free Exams Sample Questions