2020 SPLK-2002 Exam - Get Splunk SPLK-2004 PDF with Questions Answers
                     Splunk
SPLK-2002
[ Total Questions: 10]
https://www.dumpsforsure.com/splunk/splk-2002-dumps.html
Web: www.marks4sure.com
Splunk - SPLK-2002
Question #:1
Which of the following should be done when installing Enterprise Security on a Search Head Cluster? (Select
all that apply.)
A.  Install Enterprise Security on the deployer.
B.  Install Enterprise Security on a staging instance.
C.  Copy the Enterprise Security configurations to the deployer.
D.  Use the deployer to deploy Enterprise Security to the cluster members.
Answer: A D
Question #:2
Which component in the splunkd.log will log information related to bad event breaking?
A.  Audittrail
B.  EventBreaking
C.  IndexingPipeline
D.  AggregatorMiningProcessor
Answer: D
Question #:3
Which CLI command converts a Splunk instance to a license slave?
A.  splunk add licenses
B.  splunk list licenser-slaves
C.  splunk edit licenser-localslave
D.  splunk list licenser-localslave
Answer: C
Question #:4
1 of 4
Splunk - SPLK-2002
Which of the following statements about integrating with third-party systems is true? (Select all that apply.)
A.  A Hadoop application can search data in Splunk.
B.  Splunk can search data in the Hadoop File System (HDFS).
C.  You can use Splunk alerts to provision actions on a third-party system.
D.  You can forward data from Splunk forwarder to a third-party system without indexing it first.
Answer: C D
Question #:5
A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no
enforcement license on the same license master. How much data can the customer ingest before search is
locked out?
A.  300GB. After this limit, search is locked out.
B.  500GB. After this limit, search is locked out.
C.  800GB. After this limit, search is locked out.
D.  Search is not locked out. Violations are still recorded.
Answer: D
Question #:6
Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers
running Splunk Enterprise Security?
A.  Setting the cluster search factor to N-1.
B.  Increasing the number of buckets per index.
C.  Decreasing the data model acceleration range.
D.  Setting the cluster replication factor to N-1.
Answer: D
Question #:7
2 of 4
Splunk - SPLK-2002
Before users can use a KV store, an admin must create a collection. Where is a collection is defined?
A.  kvstore.conf
B.  collection.conf
C.  collections.conf
D.  kvcollections.conf
Answer: C
Question #:8
Which Splunk Enterprise offering has its own license?
A.  Splunk Cloud Forwarder
B.  Splunk Heavy Forwarder
C.  Splunk Universal Forwarder
D.  Splunk Forwarder Management
Answer: C
Question #:9
In which phase of the Splunk Enterprise data pipeline are indexed extraction configurations processed?
A.  Input
B.  Search
C.  Parsing
D.  Indexing
Answer: C
Question #:10
Which of the following is a good practice for a search head cluster deployer?
A.  The deployer only distributes configurations to search head cluster members when they “phone home”.
3 of 4
Splunk - SPLK-2002
B.  The deployer must be used to distribute non-replicable configurations to search head cluster members.
C.  The deployer must distribute configurations to search head cluster members to be valid configurations.
D.  The deployer only distributes configurations to search head cluster members with splunk apply
shcluster-bundle.
Answer: A
https://www.dumpsforsure.com/splunk/splk-2002-dumps.html
4 of 4