SPLK-2002 Splunk Exam Questions and Free Practice Test

Question 7

Which of the following are true statements about Splunk indexer clustering?

A. All peer nodes must run exactly the same Splunk version.

B. The master node must run the same or a later Splunk version than search heads.

C. The peer nodes must run the same or a later Splunk version than the master node.

D. The search head must run the same or a later Splunk version than the peer nodes.

Correct Answer:B

Question 8

When troubleshooting monitor inputs, which command checks the status of the tailed files?

A. splunk cmd btool inputs list | tail

B. splunk cmd btool check inputs layer

C. curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus

D. curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:Tailstatus

Correct Answer:C

Question 9

Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?

A. System local directory.

B. System default directory.

C. App local directories, in ASCII order.

D. App default directories, in ASCII order.

Correct Answer:A

Question 10

Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?

A. Data encryption between Splunk Web and splunkd.

B. Certificate authentication between forwarders and indexers.

C. Certificate authentication between Splunk Web and search head.

D. Data encryption for distributed search between search heads and indexers.

Correct Answer:B

Question 11

In search head clustering, which of the following methods can you use to transfer captaincy to a different member? (Select all that apply.)

A. Use the Monitoring Console.

B. Use the Search Head Clustering settings menu from Splunk Web on any member.

C. Run the splunk transfer shcluster-captain command from the current captain.

D. Run the splunk transfer shcluster-captain command from the member you would like to become the captain.

Correct Answer:BD

Question 12

Which Splunk internal index contains licenserelated events?

A. _audit

B. _license

C. _internal

D. _introspection

Correct Answer:C

START SPLK-2002 EXAM