Splunk SPLK-2002 Splunk Enterprise Certified Architect Exam Practice Test Questions

• Question 1

  Which of the following statements describe licensing in a clustered Splunk deployment? (Select all that apply.)

  • Free licenses do not support clustering.
  • Replicated data does not count against licensing.
  • Each cluster member requires its own clustering license.
  • Cluster members must share the same license pool and license master.

  Show Answer Answer: B,D Next

• Question 2

  What is the algorithm used to determine captaincy in a Splunk search head cluster?

  • Raft distributed consensus.
  • Rapt distributed consensus.
  • Rift distributed consensus.
  • Round-robin distribution consensus.

  Show Answer Answer: A Next

• Question 3

  Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor has built one. What are the items that must be evaluated before installing the add-on? (Select all that apply.)

  • Identify number of scheduled or real-time searches.
  • Validate if this Technical Add-On enables event data for a data model.
  • Identify the maximum number of forwarders Technical Add-On can support.
  • Verify if Technical Add-On needs to be installed onto both a search head or indexer.

  Show Answer Answer: A,C Next

• Question 4

  Which two sections can be expanded using the Search Job Inspector?

  • Execution costs.
  • Saved search history.
  • Search job properties.
  • Optimization suggestions.

  Show Answer Answer: B,C Next

• Question 5

  A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master. How much data can the customer ingest before search is locked out?

  • 300GB. After this limit, search is locked out.
  • 500GB. After this limit, search is locked out.
  • 800GB. After this limit, search is locked out.
  • Search is not locked out. Violations are still recorded.

  Show Answer Answer: D Next