Free Splunk Enterprise Certified Architect SPLK-2002 Exam Practice Test

When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

• 1. Delete Splunk Enterprise, if it exists.2. Install and initialize the instance.3. Join the SHC.
• 1. Install and initialize the instance.2. Delete Splunk Enterprise, if it exists.3. Join the SHC.
• 1. Initialize cluster rebalance operation.2. Remove master node from cluster.3. Trigger replication.
• 1. Trigger replication.2. Remove master node from cluster.3. Initialize cluster rebalance operation.

What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

• Distributes apps to SHC members.
• Bootstraps a clean Splunk install for a SHC.
• Distributes non-search related and manual configuration file changes.
• Distributes runtime knowledge object changes made by users across the SHC.

The KV store forms its own cluster within a SHC. What is the maximum number of SHC members KV store will form?

• 25
• 50
• 100
• Unlimited

When Splunk indexes data in a non clustered environment, what kind of files does it create by default?

• Index and .tsidx files.
• Rawdata and index files.
• Compressed and .tsidx files.
• Compressed and meta data files.

To optimize the distribution of primary buckets; when does primary rebalancing automatically occur? (Select all that apply.)

• Rolling restart completes.
• Master node rejoins the cluster.
• Captain joins or rejoins cluster.
• A peer node joins or rejoins the cluster.

The frequency in which a deployment client contacts the deployment server is controlled by what?

• polling_interval attribute in outputs.conf
• phoneHomeIntervalInSecs attribute in outputs.conf
• polling_interval attribute in deploymentclient.conf
• phoneHomeIntervalInSecs attribute in deploymentclient.conf

Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor has built one. What are the items that must be evaluated before installing the add-on? (Select all that apply.)

• Identify number of scheduled or real-time searches.
• Validate if this Technical Add-On enables event data for a data model.
• Identify the maximum number of forwarders Technical Add-On can support.
• Verify if Technical Add-On needs to be installed onto both a search head or indexer.

A search head has successfully joined a single site indexer cluster. Which command is used to configure the same search head to join another indexer cluster?

• splunk add cluster-config
• splunk add cluster-master
• splunk edit cluster-config
• splunk edit cluster-master

Of the following types of files within an index bucket, which file type may consume the most disk?

• Rawdata
• Bloom filter
• Metadata (.data)
• Inverted index (.tsidx)

Which search head cluster component is responsible for pushing knowledge bundles to search peers, replicating configuration changes to search head cluster members, and scheduling jobs across the search head cluster?

• Master
• Captain
• Deployer
• Deployment server