SPLK-2002 Practice Test

Which of the following should be included in a deployment plan?

A.

Business continuity and disaster recovery plans.

B.

Current logging details and data source inventory.

C.

Current and future topology diagrams of the IT environment.

D.

A comprehensive list of stakeholders, either direct or indirect

Which of the following is a good practice for a search head cluster deployer?

A.

The deployer only distributes configurations to search head cluster members when they “phone home”.

B.

The deployer must be used to distribute non-replicable configurations to search head cluster members.

C.

The deployer must distribute configurations to search head cluster members to be valid configurations.

D.

The deployer only distributes configurations to search head cluster members with splunk apply
shcluster-bundle.

A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?

A.

Configure syslog to send the data to multiple Splunk indexers.

B.

Use a Splunk indexer to collect a network input on port 514 directly.

C.

Use a Splunk forwarder to collect the input on port 514 and forward the data.

D.

Configure syslog to write logs and use a Splunk forwarder to collect the logs.

In the deployment planning process, when should a person identify who gets to see network data?

A.

Deployment schedule

B.

Topology diagramming

C.

Data source inventory

D.

Data policy definition

To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

A.

adhoc_searchhead = true (on all members)

B.

adhoc_searchhead = true (on the current captain)

C.

captain_is_adhoc_searchhead = true (on all members)

D.

captain_is_adhoc_searchhead = true (on the current captain)