File Info
| Exam | Splunk Enterprise Certified Architect |
| Number | SPLK-2002 |
| File Name | Splunk.SPLK-2002.TestKing.2019-10-22.43q.vcex |
| Size | 26 KB |
| Posted | Oct 22, 2019 |
| Download | Splunk.SPLK-2002.TestKing.2019-10-22.43q.vcex |
How to open VCEX & EXAM Files?
Files with VCEX & EXAM extensions can be opened by ProfExam Simulator.
Coupon: MASTEREXAM
With discount: 20%
Demo Questions
Question 1
Which of the following should be included in a deployment plan?
- Business continuity and disaster recovery plans.
- Current logging details and data source inventory.
- Current and future topology diagrams of the IT environment.
- A comprehensive list of stakeholders, either direct or indirect.
Correct answer: D
Explanation:
Reference: https://docs.splunk.com/Documentation/CoE/ssf/Handbook/StakeholderReg Reference: https://docs.splunk.com/Documentation/CoE/ssf/Handbook/StakeholderReg
Question 2
A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)
- Via Splunk Web.
- Directly edit SPLUNK_HOME/etc/system/local/server.conf
- Run a splunk edit cluster-config command from the CLI.
- Directly edit SPLUNK_HOME/etc/system/default/server.conf
Correct answer: AB
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Enableclustersindetail Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Enableclustersindetail
Question 3
What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?
- btool.log
- metrics.log
- splunkd.log
- tailing_processor.log
Correct answer: C
Explanation:
Reference: https://answers.splunk.com/answers/479312/how-to-edit-inputsconf-to-monitor-multiple-files-w-1.html Reference: https://answers.splunk.com/answers/479312/how-to-edit-inputsconf-to-monitor-multiple-files-w-1.html
Question 4
Which Splunk tool offers a health check for administrators to evaluate the health of their Splunk deployment?
- btool
- DiagGen
- SPL Clinic
- Monitoring Console
Correct answer: D
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DMC/DMCoverview Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DMC/DMCoverview
Question 5
In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?
- site_search_factor = origin:2, site1:2, total:4
- site_search_factor = origin:2, site2:1, total:4
- site_replication_factor = origin:2, site1:2, total:4
- site_replication_factor = origin:2, site2:1, total:4
Correct answer: D
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Sitereplicationfactor Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Sitereplicationfactor
Question 6
Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)
- Adding search peers increases the maximum size of search results.
- Adding RAM to an existing search heads provides additional search capacity.
- Adding search peers increases the search throughput as search load increases.
- Adding search heads provides additional CPU cores to run more concurrent searches.
Correct answer: BD
Explanation:
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/HowsavedsearchesaffectSplunkEnterpriseperformance Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/HowsavedsearchesaffectSplunkEnterpriseperformance
Question 7
Which Splunk Enterprise offering has its own license?
- Splunk Cloud Forwarder
- Splunk Heavy Forwarder
- Splunk Universal Forwarder
- Splunk Forwarder Management
Correct answer: C
Explanation:
Reference: https://docs.splunk.com/Splexicon:Forwardinglicense Reference: https://docs.splunk.com/Splexicon:Forwardinglicense
Question 8
The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. How does this divide between files in the index?
- rawdata is: 10%, tsidx is: 40%
- rawdata is: 15%, tsidx is: 35%
- rawdata is: 35%, tsidx is: 15%
- rawdata is: 40%, tsidx is: 10%
Correct answer: B
Explanation:
Reference: https://answers.splunk.com/answers/147951/what-is-the-compression-ratio-of-raw-data-in-splunk.html Reference: https://answers.splunk.com/answers/147951/what-is-the-compression-ratio-of-raw-data-in-splunk.html
Question 9
In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files.
What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?
- Total daily indexing volume, number of peer nodes, and number of accelerated searches.
- Total daily indexing volume, number of peer nodes, replication factor, and search factor.
- Total daily indexing volume, replication factor, search factor, and number of search heads.
- Replication factor, search factor, number of accelerated searches, and total disk size across cluster.
Correct answer: D
Question 10
A three-node search head cluster is skipping a large number of searches across time. What should be done to increase scheduled search capacity on the search head cluster?
- Create a job server on the cluster.
- Add another search head to the cluster.
- server.conf captain_is_adhoc_searchhead = true.
- Change limits.conf value for max_searches_per_cpu to a higher value.
Correct answer: D
