Splunk SPLK-2002 問題集

質問 1：
Which of the following Splunk deployments has the recommended minimum components for a high-availability search head cluster?
A. 2 search heads, 1 deployer, 3 indexers
B. 3 search heads, 1 deployer, 3 indexers
C. 1 search head, 1 deployer, 3 indexers
D. 2 search heads, 1 deployer, 2 indexers
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Which of the following are true statements about Splunk indexer clustering?
A. The search head must run the same or a later Splunk version than the peer nodes.
B. The peer nodes must run the same or a later Splunk version than the master node.
C. The master node must run the same or a later Splunk version than search heads.
D. All peer nodes must run exactly the same Splunk version.
正解：A,D
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?
A. Decreasing the data model acceleration range.
B. Setting the cluster search factor to N-1.
C. Increasing the number of buckets per index.
D. Setting the cluster replication factor to N-1.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 4：
A monitored log file is changing on the forwarder. However, Splunk searches are not finding any new data that has been added. What are possible causes? (select all that apply)
A. The first 256 bytes of the monitored file are not changing.
B. An admin has removed the Splunk fishbucket on the forwarder.
C. An admin ran splunk clean eventdata -index <indexname> on the indexer.
D. The last 256 bytes of the monitored file are not changing.
正解：B,D
解説: (Topexam メンバーにのみ表示されます)

質問 5：
The master node distributes configuration bundles to peer nodes. Which directory peer nodes receive the bundles?
A. slave-apps
B. master-apps
C. apps
D. deployment-apps
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 6：
A Splunk instance has crashed, but no crash log was generated. There is an attempt to determine what user activity caused the crash by running the following search:

What does searching for closed_txn=0 do in this search?
A. Filters results to situations where Splunk was started and stopped once.
B. Filters results to situations where Splunk was started, but not stopped.
C. Filters results to situations where Splunk was started and stopped multiple times.
D. Filters results to situations where Splunk was stopped and then immediately restarted.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 7：
In search head clustering, which of the following methods can you use to transfer captaincy to a different member? (Select all that apply.)
A. Use the Search Head Clustering settings menu from Splunk Web on any member.
B. Run the splunk transfer shcluster-captain command from the member you would like to become the captain.
C. Use the Monitoring Console.
D. Run the splunk transfer shcluster-captain command from the current captain.
正解：A,B
解説: (Topexam メンバーにのみ表示されます)