Question 1

Which of the following statements describe licensing in a clustered Splunk deployment? (Select all that apply.)

Options :

A : Free licenses do not support clustering.

B : Replicated data does not count against licensing.

C : Each cluster member requires its own clustering license.

D : Cluster members must share the same license pool and license master.

Answer: B,D

Question 2

Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor

has built one. What are the items that must be evaluated before installing the add-on? (Select all that apply.)

Options :

A : Identify number of scheduled or real-time searches.

B : Validate if this Technical Add-On enables event data for a data model.

C : Identify the maximum number of forwarders Technical Add-On can support.

D : Verify if Technical Add-On needs to be installed onto both a search head or indexer.

Answer: A,C

Question 3

A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the

best practice for ingesting this data into Splunk?

Options :

A : Configure syslog to send the data to multiple Splunk indexers.

B : Use a Splunk indexer to collect a network input on port 514 directly.

C : Use a Splunk forwarder to collect the input on port 514 and forward the data.

D : Configure syslog to write logs and use a Splunk forwarder to collect the logs

Answer: D

Question 4

The frequency in which a deployment client contacts the deployment server is controlled by what?

Options :

A : polling_interval attribute in outputs.conf

B : phoneHomeIntervalInSecs attribute in outputs.conf

C : polling_interval attribute in deploymentclient.conf

D : phoneHomeIntervalInSecs attribute in deploymentclient.conf

Answer: D

Question 5

What is a Splunk Job? (Select all that apply.)

Options :

A : A user-defined Splunk capability.

B : Searches that are subjected to some usage quota.

C : A search process kicked off via a report or an alert.

D : A child OS process manifested from the splunkd process.

Answer: A

Confidently Practice Online with Free SPLK-2002 Exam Cram