Question 1

Which of the following is a way to exclude search artifacts when creating a diag ?

Accepted Answer

A)  SPLUNK_HOME/bin/splunk diag --exclude 
B)  SPLUNK_HOME/bin/splunk diag --debug --refresh 
C)  SPLUNK_HOME/bin/splunk diag --disable=dispatch 
D)  SPLUNK_HOME/bin/splunk diag --filter-searchstrings 
A)  SPLUNK_HOME/bin/splunk diag --exclude 
B)  SPLUNK_HOME/bin/splunk diag --debug --refresh 
C)  SPLUNK_HOME/bin/splunk diag --disable=dispatch 
D)  SPLUNK_HOME/bin/splunk diag --filter-searchstrings

Question 2

Of the following types of files within an index bucket, which file type may consume the most disk?

Accepted Answer

A)  Rawdata 
B)  Bloom filter 
C)  Metadata (.data) 
D)  Inverted index (.tsidx) 
A)  Rawdata 
B)  Bloom filter 
C)  Metadata (.data) 
D)  Inverted index (.tsidx)

Question 3

In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files. What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?

Accepted Answer

A)  Total daily indexing volume, number of peer nodes, and number of accelerated searches. 
B)  Total daily indexing volume, number of peer nodes, replication factor, and search factor. 
C)  Total daily indexing volume, replication factor, search factor, and number of search heads. 
D)  Replication factor, search factor, number of accelerated searches, and total disk size across cluster. 
A)  Total daily indexing volume, number of peer nodes, and number of accelerated searches. 
B)  Total daily indexing volume, number of peer nodes, replication factor, and search factor. 
C)  Total daily indexing volume, replication factor, search factor, and number of search heads. 
D)  Replication factor, search factor, number of accelerated searches, and total disk size across cluster.

Question 4

When converting from a single-site to a multi-site cluster, what happens to existing single-site clustered buckets?

Accepted Answer

A)  They will continue to replicate within the origin site and age out based on existing policies. 
B)  They will maintain replication as required according to the single-site policies, but never age out. 
C)  They will be replicated across all peers in the multi-site cluster and age out based on existing policies. 
D)  They will stop replicating within the single-site and remain on the indexer they reside on and age out according to existing policies. 
A)  They will continue to replicate within the origin site and age out based on existing policies. 
B)  They will maintain replication as required according to the single-site policies, but never age out. 
C)  They will be replicated across all peers in the multi-site cluster and age out based on existing policies. 
D)  They will stop replicating within the single-site and remain on the indexer they reside on and age out according to existing policies.

Question 5

Which command will permanently decommission a peer node operating in an indexer cluster?

Accepted Answer

A)  splunk stop -f 
B)  splunk offline -f 
C)  splunk offline --enforce-counts 
D)  splunk decommission --enforce counts 
A)  splunk stop -f 
B)  splunk offline -f 
C)  splunk offline --enforce-counts 
D)  splunk decommission --enforce counts

Question 6

What is the algorithm used to determine captaincy in a Splunk search head cluster?

Accepted Answer

A)  Raft distributed consensus. 
B)  Rapt distributed consensus. 
C)  Rift distributed consensus. 
D)  Round-robin distribution consensus. 
A)  Raft distributed consensus. 
B)  Rapt distributed consensus. 
C)  Rift distributed consensus. 
D)  Round-robin distribution consensus.

Question 7

A Splunk user successfully extracted an ip address into a field called src_ip . Their colleague cannot see that field in their search results with events known to have . Which of the following may explain the problem? (Select all that apply.)

Accepted Answer

A)  The field was extracted as a private knowledge object. 
B)  The events are tagged as communicate, but are missing the network tag. 
C)  The Typing Queue, which does regular expression replacements, is blocked. 
D)  The colleague did not explicitly use the field in the search and the search was set to Fast Mode. 
A)  The field was extracted as a private knowledge object. 
B)  The events are tagged as communicate, but are missing the network tag. 
C)  The Typing Queue, which does regular expression replacements, is blocked. 
D)  The colleague did not explicitly use the field in the search and the search was set to Fast Mode.

Question 8

Which of the following should be included in a deployment plan?

Accepted Answer

A)  Business continuity and disaster recovery plans. 
B)  Current logging details and data source inventory. 
C)  Current and future topology diagrams of the IT environment. 
D)  A comprehensive list of stakeholders, either direct or indirect. 
A)  Business continuity and disaster recovery plans. 
B)  Current logging details and data source inventory. 
C)  Current and future topology diagrams of the IT environment. 
D)  A comprehensive list of stakeholders, either direct or indirect.

Question 9

A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

Accepted Answer

A)  Two indexers not in a cluster, assuming users run many long searches. 
B)  Three indexers not in a cluster, assuming a long data retention period. 
C)  Two indexers clustered, assuming high availability is the greatest priority. 
D)  Two indexers clustered, assuming a high volume of saved/scheduled searches. 
A)  Two indexers not in a cluster, assuming users run many long searches. 
B)  Three indexers not in a cluster, assuming a long data retention period. 
C)  Two indexers clustered, assuming high availability is the greatest priority. 
D)  Two indexers clustered, assuming a high volume of saved/scheduled searches.

Question 10

Which of the following statements about integrating with third-party systems is true? (Select all that apply.)

Accepted Answer

A)  A Hadoop application can search data in Splunk. 
B)  Splunk can search data in the Hadoop File System (HDFS). 
C)  You can use Splunk alerts to provision actions on a third-party system. 
D)  You can forward data from Splunk forwarder to a third-party system without indexing it first. 
A)  A Hadoop application can search data in Splunk. 
B)  Splunk can search data in the Hadoop File System (HDFS). 
C)  You can use Splunk alerts to provision actions on a third-party system. 
D)  You can forward data from Splunk forwarder to a third-party system without indexing it first.

Question 11

Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)

Accepted Answer

A)  Adding search peers increases the maximum size of search results. 
B)  Adding RAM to an existing search heads provides additional search capacity. 
C)  Adding search peers increases the search throughput as search load increases. 
D)  Adding search heads provides additional CPU cores to run more concurrent searches. 
A)  Adding search peers increases the maximum size of search results. 
B)  Adding RAM to an existing search heads provides additional search capacity. 
C)  Adding search peers increases the search throughput as search load increases. 
D)  Adding search heads provides additional CPU cores to run more concurrent searches.

Question 12

Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor has built one. What are the items that must be evaluated before installing the add-on? (Select all that apply.)

Accepted Answer

A)  Identify number of scheduled or real-time searches. 
B)  Validate if this Technical Add-On enables event data for a data model. 
C)  Identify the maximum number of forwarders Technical Add-On can support. 
D)  Verify if Technical Add-On needs to be installed onto both a search head or indexer. 
A)  Identify number of scheduled or real-time searches. 
B)  Validate if this Technical Add-On enables event data for a data model. 
C)  Identify the maximum number of forwarders Technical Add-On can support. 
D)  Verify if Technical Add-On needs to be installed onto both a search head or indexer.

Question 13

When planning a search head cluster, which of the following is true?

Accepted Answer

A)  All search heads must use the same operating system. 
B)  All search heads must be members of the cluster (no standalone search heads). 
C)  The search head captain must be assigned to the largest search head in the cluster. 
D)  All indexers must belong to the underlying indexer cluster (no standalone indexers). 
A)  All search heads must use the same operating system. 
B)  All search heads must be members of the cluster (no standalone search heads). 
C)  The search head captain must be assigned to the largest search head in the cluster. 
D)  All indexers must belong to the underlying indexer cluster (no standalone indexers).

Question 14

A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master. How much data can the customer ingest before search is locked out?

Accepted Answer

A)  300GB. After this limit, search is locked out. 
B)  500GB. After this limit, search is locked out. 
C)  800GB. After this limit, search is locked out. 
D)  Search is not locked out. Violations are still recorded. 
A)  300GB. After this limit, search is locked out. 
B)  500GB. After this limit, search is locked out. 
C)  800GB. After this limit, search is locked out. 
D)  Search is not locked out. Violations are still recorded.

Question 15

When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

Accepted Answer

A)  1. Delete Splunk Enterprise, if it exists. 2. Install and initialize the instance. 3. Join the SHC. 
B)  1. Install and initialize the instance. 2. Delete Splunk Enterprise, if it exists. 
C)  1. Initialize cluster rebalance operation. 2. Remove master node from cluster. 3. Trigger replication. 
D)  1. Trigger replication. 3. Initialize cluster rebalance operation. 
A)  1. Delete Splunk Enterprise, if it exists. 2. Install and initialize the instance. 3. Join the SHC. 
B)  1. Install and initialize the instance. 2. Delete Splunk Enterprise, if it exists. 
C)  1. Initialize cluster rebalance operation. 2. Remove master node from cluster. 3. Trigger replication. 
D)  1. Trigger replication. 3. Initialize cluster rebalance operation.

Question 16

How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?

Accepted Answer

A)  ITSI requires a dedicated deployment server. 
B)  The amount of users using ITSI will not impact performance. 
C)  ITSI in a Splunk deployment does not require additional hardware resources. 
D)  Depending on the Key Performance Indicators that are being tracked, additional infrastructure may be needed. 
A)  ITSI requires a dedicated deployment server. 
B)  The amount of users using ITSI will not impact performance. 
C)  ITSI in a Splunk deployment does not require additional hardware resources. 
D)  Depending on the Key Performance Indicators that are being tracked, additional infrastructure may be needed.

Question 17

Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)

Accepted Answer

A)  telnet 
B)  tcpdump 
C)  splunk btool 
D)  splunk btprobe 
A)  telnet 
B)  tcpdump 
C)  splunk btool 
D)  splunk btprobe

Question 18

Which of the following should be done when installing Enterprise Security on a Search Head Cluster? (Select all that apply.)

Accepted Answer

A)  Install Enterprise Security on the deployer. 
B)  Install Enterprise Security on a staging instance. 
C)  Copy the Enterprise Security configurations to the deployer. 
D)  Use the deployer to deploy Enterprise Security to the cluster members. 
A)  Install Enterprise Security on the deployer. 
B)  Install Enterprise Security on a staging instance. 
C)  Copy the Enterprise Security configurations to the deployer. 
D)  Use the deployer to deploy Enterprise Security to the cluster members.

Question 19

Which component in the splunkd.log will log information related to bad event breaking?

Accepted Answer

A)  Audittrail 
B)  EventBreaking 
C)  IndexingPipeline 
D)  AggregatorMiningProcessor 
A)  Audittrail 
B)  EventBreaking 
C)  IndexingPipeline 
D)  AggregatorMiningProcessor

Question 20

Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

Accepted Answer

A)  REPORT 
B)  LINE_BREAKER 
C)  ANNOTATE_PUNCT 
D)  SHOULD_LINEMERGE 
A)  REPORT 
B)  LINE_BREAKER 
C)  ANNOTATE_PUNCT 
D)  SHOULD_LINEMERGE

Which of the following is a way to exclude search artifacts when creating a diag ?

Of the following types of files within an index bucket, which file type may consume the most disk?

When converting from a single-site to a multi-site cluster, what happens to existing single-site clustered buckets?

Which command will permanently decommission a peer node operating in an indexer cluster?

What is the algorithm used to determine captaincy in a Splunk search head cluster?

A Splunk user successfully extracted an ip address into a field called src_ip . Their colleague cannot see that field in their search results with events known to have . Which of the following may explain the problem? (Select all that apply.)

Which of the following should be included in a deployment plan?

Which of the following statements about integrating with third-party systems is true? (Select all that apply.)

Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)

Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor has built one. What are the items that must be evaluated before installing the add-on? (Select all that apply.)

When planning a search head cluster, which of the following is true?

A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master. How much data can the customer ingest before search is locked out?

When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?

Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)

Which of the following should be done when installing Enterprise Security on a Search Head Cluster? (Select all that apply.)

Which component in the splunkd.log will log information related to bad event breaking?

Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

Splunk Core Certified User

Splunk Enterprise Certified Admin

Splunk Certified Developer

Splunk Enterprise Certified Architect

Splunk IT Service Intelligence Certified Admin

Splunk Core Certified Consultant

Filters

Exam 5: Splunk Enterprise Security Certified Admin

Which of the following is a way to exclude search artifacts when creating a diag ?

Of the following types of files within an index bucket, which file type may consume the most disk?

When converting from a single-site to a multi-site cluster, what happens to existing single-site clustered buckets?

Which command will permanently decommission a peer node operating in an indexer cluster?

What is the algorithm used to determine captaincy in a Splunk search head cluster?

A Splunk user successfully extracted an ip address into a field called src_ip . Their colleague cannot see that field in their search results with events known to have . Which of the following may explain the problem? (Select all that apply.)

Which of the following should be included in a deployment plan?

Which of the following statements about integrating with third-party systems is true? (Select all that apply.)

Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)

Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor has built one. What are the items that must be evaluated before installing the add-on? (Select all that apply.)

When planning a search head cluster, which of the following is true?

A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master. How much data can the customer ingest before search is locked out?

When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

How does IT Service Intelligence (ITSI) impact the planning of a Splunk deployment?

Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)

Which of the following should be done when installing Enterprise Security on a Search Head Cluster? (Select all that apply.)

Which component in the splunkd.log will log information related to bad event breaking?

Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

Splunk Core Certified User

Splunk Enterprise Certified Admin

Splunk Certified Developer

Splunk Enterprise Certified Architect

Splunk IT Service Intelligence Certified Admin

Splunk Core Certified Consultant

Filters