Use the best ways of preparing for SPLK-2002 Exam Dumps with ActualCollection Splunk SPLK-2002 dump PDF [2021]
Splunk SPLK-2002 exam candidates will surely pass the Exam if they consider the SPLK-2002 dumps learning material presented by ActualCollection.
NEW QUESTION 13
Which Splunk internal index contains license-related events?
- A. _audit
- B. _introspection
- C. _license
- D. _internal
Answer: D
Explanation:
Explanation/Reference: https://answers.splunk.com/answers/579494/how-to-display-license-consumed-by-an-index-over-
2.html
NEW QUESTION 14
Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?
- A. Certificate authentication between forwarders and indexers.
- B. Data encryption for distributed search between search heads and indexers.
- C. Data encryption between Splunk Web and splunkd.
- D. Certificate authentication between Splunk Web and search head.
Answer: A
NEW QUESTION 15
Which of the following clarification steps should be taken if apps are not appearing on a deployment client?
(Select all that apply.)
- A. Check deploymentclient.conf of the deployment client.
- B. Search for relevant events in splunkd.log of the deployment server.
- C. Check the content of SPLUNK_HOME/etc/apps of the deployment server.
- D. Check serverclass.conf of the deployment server.
Answer: A,C,D
NEW QUESTION 16
When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of
operations?
- A. 1. Install and initialize the instance.
2. Delete Splunk Enterprise, if it exists.
3. Join the SHC. - B. 1. Initialize cluster rebalance operation.
2. Remove master node from cluster.
3. Trigger replication. - C. 1. Delete Splunk Enterprise, if it exists.
2. Install and initialize the instance.
3. Join the SHC. - D. 1. Trigger replication.
2. Remove master node from cluster.
3. Initialize cluster rebalance operation.
Answer: A
NEW QUESTION 17
What is the default log size for Splunk internal logs?
- A. 20 MB
- B. 30MB
- C. 10MB
- D. 25MB
Answer: D
NEW QUESTION 18
In the deployment planning process, when should a person identify who gets to see network data?
- A. Deployment schedule
- B. Data source inventory
- C. Topology diagramming
- D. Data policy definition
Answer: B
NEW QUESTION 19
Which of the following is a way to exclude search artifacts when creating a diag?
- A. SPLUNK_HOME/bin/splunk diag --exclude
- B. SPLUNK_HOME/bin/splunk diag --filter-searchstrings
- C. SPLUNK_HOME/bin/splunk diag --disable=dispatch
- D. SPLUNK_HOME/bin/splunk diag --debug --refresh
Answer: A
Explanation:
Explanation/Reference: https://splunkonbigdata.com/2018/10/01/splunk-diag/
NEW QUESTION 20
Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor has built one. What are the items that must be evaluated before installing the add-on? (Select all that apply.)
- A. Identify the maximum number of forwarders Technical Add-On can support.
- B. Identify number of scheduled or real-time searches.
- C. Verify if Technical Add-On needs to be installed onto both a search head or indexer.
- D. Validate if this Technical Add-On enables event data for a data model.
Answer: A,B
NEW QUESTION 21
To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?
- A. adhoc_searchhead = true (on the current captain)
- B. captain_is_adhoc_searchhead = true (on all members)
- C. adhoc_searchhead = true (on all members)
- D. captain_is_adhoc_searchhead = true (on the current captain)
Answer: D
NEW QUESTION 22
When configuring a Splunk indexer cluster, what are the default values for replication and search factor?
- A. replication_factor = 2search factor = 3
- B. replication_factor = 2search_factor = 2
- C. replication_factor = 3search_factor = 2
- D. replication_factor = 3search factor = 3
Answer: C
NEW QUESTION 23
Which Splunk Enterprise offering has its own license?
- A. Splunk Forwarder Management
- B. Splunk Cloud Forwarder
- C. Splunk Heavy Forwarder
- D. Splunk Universal Forwarder
Answer: D
NEW QUESTION 24
Which of the following can a Splunk diagcontain?
- A. Server specs, current open connections, internal Splunk log files, index listings
- B. Search history, Splunk users and their roles, running processes, indexed data
- C. Splunk platform configuration details, Splunk users and their roles, current open connections, index listings
- D. KV store listings, internal Splunk log files, search peer bundles listings, indexed data
Answer: A
Explanation:
Explanation/Reference: https://splunkonbigdata.com/2018/10/01/splunk-diag/
NEW QUESTION 25
Which of the following describe migration from single-site to multisite index replication?
- A. A master node is required at each site.
- B. Multisite total values should not exceed any single-site factors.
- C. Single-site buckets instantly receive the multisite policies.
- D. Multisite policies apply to new data only.
Answer: B
NEW QUESTION 26
What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)
- A. Bootstraps a clean Splunk install for a SHC.
- B. Distributes apps to SHC members.
- C. Distributes non-search related and manual configuration file changes.
- D. Distributes runtime knowledge object changes made by users across the SHC.
Answer: B
NEW QUESTION 27
What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a
monitor stanza?
- A. metrics.log
- B. tailing_processor.log
- C. splunkd.log
- D. btool.log
Answer: C
Explanation:
Explanation/Reference: https://answers.splunk.com/answers/479312/how-to-edit-inputsconf-to-monitor-multiple-files-w-
1.html
NEW QUESTION 28
Which CLI command converts a Splunk instance to a license slave?
- A. splunk edit licenser-localslave
- B. splunk list licenser-localslave
- C. splunk list licenser-slaves
- D. splunk add licenses
Answer: A
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/LicenserCLIcommands
NEW QUESTION 29
When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?
- A. 1. Initialize cluster rebalance operation.2. Remove master node from cluster.3. Trigger replication.
- B. 1. Delete Splunk Enterprise, if it exists.2. Install and initialize the instance.3. Join the SHC.
- C. 1. Install and initialize the instance.2. Delete Splunk Enterprise, if it exists.3. Join the SHC.
- D. 1. Trigger replication.2. Remove master node from cluster.3. Initialize cluster rebalance operation.
Answer: C
NEW QUESTION 30
Which of the following clarification steps should be taken if apps are not appearing on a deployment client?
(Select all that apply.)
- A. Check serverclass.confof the deployment server.
- B. Check deploymentclient.confof the deployment client.
- C. Check the content of SPLUNK_HOME/etc/appsof the deployment server.
- D. Search for relevant events in splunkd.logof the deployment server.
Answer: A,B,C
Explanation:
Explanation/Reference: https://answers.splunk.com/answers/177021/why-is-deployment-client-not-picking-up-changes- to.html
NEW QUESTION 31
Which Splunk internal index contains license-related events?
_audit
- A. _introspection
- B. _license
- C. _internal
Answer: C
Explanation:
Explanation/Reference: https://answers.splunk.com/answers/579494/how-to-display-license-consumed-by-an-index-over-
2.html
NEW QUESTION 32
In search head clustering, which of the following methods can you use to transfer captaincy to a different member? (Select all that apply.)
- A. Run the splunk transfer shcluster-captaincommand from the member you would like to become the captain.
- B. Use the Monitoring Console.
- C. Run the splunk transfer shcluster-captaincommand from the current captain.
- D. Use the Search Head Clustering settings menu from Splunk Web on any member.
Answer: A,D
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/Transfercaptain
NEW QUESTION 33
Which search head cluster component is responsible for pushing knowledge bundles to search peers, replicating configuration changes to search head cluster members, and scheduling jobs across the search head cluster?
- A. Deployment server
- B. Deployer
- C. Captain
- D. Master
Answer: C
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/SHCarchitecture
NEW QUESTION 34
Stakeholders have identified high availability for searchable data as their top priority. Which of the following
best addresses this requirement?
- A. Increasing the search factor in the cluster.
- B. Increasing the replication factor in the cluster.
- C. Increasing the number of search heads in the cluster.
- D. Increasing the number of CPUs on the indexers in the cluster.
Answer: B
Explanation:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/SHCarchitecture
NEW QUESTION 35
......
Full SPLK-2002 Practice Test and 92 unique questions with explanations waiting just for you, get it now: https://drive.google.com/open?id=17aJsr3-40Tpj_xFJasBERbKIX6ZVOlW7
Accurate & Verified Answers As Seen in the Real Exam here: https://www.actualcollection.com/SPLK-2002-exam-questions.html