本日更新の2022年04月試験エンジンとPDFSPLK-2002テスト無料！ [Q37-Q62]

本日更新の2022年04月試験エンジンとPDFSPLK-2002テスト無料！

究極のガイド準備SPLK-2002正確なPDF解答

質問 37
In which phase of the Splunk Enterprise data pipeline are indexed extraction configurations processed?

A. Indexing
B. Search
C. Input
D. Parsing

正解: D

解説:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/
Configurationparametersandthedatapipeline

質問 38
Which of the following security options must be explicitly configured (i.e. which options are not enabled by
default)?

A. Certificate authentication between Splunk Web and search head.
B. Data encryption for distributed search between search heads and indexers.
C. Certificate authentication between forwarders and indexers.
D. Data encryption between Splunk Web and splunkd.

正解: C

質問 39
When planning a search head cluster, which of the following is true?

A. The search head captain must be assigned to the largest search head in the cluster.
B. All indexers must belong to the underlying indexer cluster (no standalone indexers).
C. All search heads must use the same operating system.
D. All search heads must be members of the cluster (no standalone search heads).

正解: A

質問 40
What is the minimum reference server specification for a Splunk indexer?

A. 12 CPU cores, 12GB RAM, 800 IOPS
B. 16 CPU cores, 16GB RAM, 800 IOPS
C. 28 CPU cores, 32GB RAM, 1200 IOPS
D. 24 CPU cores, 16GB RAM, 1200 IOPS

正解: A

解説:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/ Referencehardware#Reference_host_specification

質問 41
Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search performance improvement?

A. Replace the indexer storage to solid state drives (SSD).
B. Look for slow searches and reschedule them to run during an off-peak time.
C. Add more search peers and make sure forwarders distribute data evenly across all indexers.
D. Add more search heads and redistribute users based on the search type.

正解: B

質問 42
Which of the following is an indexer clustering requirement?

A. Must use shared storage.
B. Must reside on a dedicated rack.
C. Must have at least three members.
D. Must share the same license pool.

正解: D

質問 43
To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from
running on the captain?

A. captain_is_adhoc_searchhead = true(on all members)
B. adhoc_searchhead = true(on all members)
C. captain_is_adhoc_searchhead = true(on the current captain)
D. adhoc_searchhead = true(on the current captain)

正解: C

解説:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/Adhocclustermember

質問 44
Which search will show all deployment client messages from the client (UF)?

A. index=_internal component= DC* host=<uf> | stats count by message
B. index=_audit component=DC* host=<ds> | stats count by message
C. index=_internal component=DS* host=<ds> | stats count by message
D. index=_audit component=DC* host=<uf> | stats count by message

正解: C

解説:
Explanation/Reference: https://answers.splunk.com/answers/461939/after-all-clients-are-registered-to-a-deployment-s.html

質問 45
A Splunk instance has the following settings in SPLUNK_HOME/etc/system/local/server.conf:
[clustering]
mode = master
replication_factor = 2
pass4SymmKey = password123
Which of the following statements describe this Splunk instance? (Select all that apply.)

A. This Splunk instance needs to be restarted.
B. This is a multi-site cluster.
C. This instance is missing the master_uriattribute.
D. This cluster's search factor is 2.

正解: A,C

質問 46
What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?

A. metrics.log
B. tailing_processor.log
C. btool.log
D. splunkd.log

正解: D

質問 47
In the deployment planning process, when should a person identify who gets to see network data?

A. Data policy definition
B. Topology diagramming
C. Data source inventory
D. Deployment schedule

正解: C

質問 48
The KV store forms its own cluster within a SHC. What is the maximum number of SHC members KV store will
form?

A. 0
B. Unlimited
C. 1
D. 2

正解: B

質問 49
When planning a search head cluster, which of the following is true?

A. The search head captain must be assigned to the largest search head in the cluster.
B. All indexers must belong to the underlying indexer cluster (no standalone indexers).
C. All search heads must use the same operating system.
D. All search heads must be members of the cluster (no standalone search heads).

正解: A

解説:
Explanation

質問 50
When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of
operations?

A. 1. Install and initialize the instance.
2. Delete Splunk Enterprise, if it exists.
3. Join the SHC.
B. 1. Initialize cluster rebalance operation.
2. Remove master node from cluster.
3. Trigger replication.
C. 1. Trigger replication.
2. Remove master node from cluster.
3. Initialize cluster rebalance operation.
D. 1. Delete Splunk Enterprise, if it exists.
2. Install and initialize the instance.
3. Join the SHC.

正解: A

質問 51
Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

A. High performance SAN should never be used.
B. Enable NFS for storing hot and warm buckets.
C. The recommended RAID setup is RAID 10 (1 + 0).
D. Virtualized environments are usually preferred over bare metal for Splunk indexers.

正解: C

解説:
Explanation/Reference: https://www.splunk.com/pdfs/technical-briefs/splunk-deploying-vmware-tech-brief.pdf

質問 52
To improve Splunk performance, parallelIngestionPipelines setting can be adjusted on which of the following components in the Splunk architecture? (Select all that apply.)

A. Cluster master
B. Indexers
C. Forwarders
D. Search head

正解: B,C

質問 53
To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

A. adhoc_searchhead = true (on all members)
B. captain_is_adhoc_searchhead = true (on the current captain)
C. captain_is_adhoc_searchhead = true (on all members)
D. adhoc_searchhead = true (on the current captain)

正解: B

質問 54
What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a
monitor stanza?

A. metrics.log
B. tailing_processor.log
C. btool.log
D. splunkd.log

正解: D

解説:
Explanation/Reference: https://answers.splunk.com/answers/479312/how-to-edit-inputsconf-to-monitor-multiple-files-w-
1.html

質問 55
Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers
running Splunk Enterprise Security?

A. Setting the cluster replication factor to N-1.
B. Decreasing the data model acceleration range.
C. Increasing the number of buckets per index.
D. Setting the cluster search factor to N-1.

正解: A

解説:
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Systemrequirements

質問 56
A new Splunk customer is using syslog to collect data from their network devices on port 514. What is the best practice for ingesting this data into Splunk?

A. Configure syslog to write logs and use a Splunk forwarder to collect the logs.
B. Use a Splunk indexer to collect a network input on port 514 directly.
C. Configure syslog to send the data to multiple Splunk indexers.
D. Use a Splunk forwarder to collect the input on port 514 and forward the data.

正解: A

解説:
Explanation/Reference: https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/Data/Monitornetworkports

質問 57
Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

A. Increasing the number of search heads in the cluster.
B. Increasing the search factor in the cluster.
C. Increasing the replication factor in the cluster.
D. Increasing the number of CPUs on the indexers in the cluster.

正解: C

質問 58
The frequency in which a deployment client contacts the deployment server is controlled by what?

A. polling_interval attribute in outputs.conf
B. phoneHomeIntervalInSecs attribute in outputs.conf
C. phoneHomeIntervalInSecs attribute in deploymentclient.conf
D. polling_interval attribute in deploymentclient.conf

正解: C

質問 59
In a distributed environment, knowledge object bundles are replicated from the search head to which location on the search peer(s)?

A. SPLUNK_HOME/var/run/searchpeers
B. SPLUNK_HOME/var/spool/searchpeers
C. SPLUNK_HOME/var/lib/searchpeers
D. SPLUNK_HOME/var/log/searchpeers

正解: A

質問 60
A Splunk architect has inherited the Splunk deployment at Buttercup Games and end users are complaining that the events are inconsistently formatted for a web sourcetype. Further investigation reveals that not all web logs flow through the same infrastructure: some of the data goes through heavy forwarders and some of the forwarders are managed by another department.
Which of the following items might be the cause for this issue?

A. The data inputs are not properly configured across all the forwarders.
B. The forwarders managed by the other department are an older version than the rest.
C. The indexers may have different configurations than the heavy forwarders.
D. The search head may have different configurations than the indexers.

正解: B

質問 61
How does the average run time of all searches relate to the available CPU cores on the indexers?

A. Average run time increases as the number of CPU cores on the indexers increases.
B. Average run time increases as the number of CPU cores on the indexers decreases.
C. Average run time is independent of the number of CPU cores on the indexers.
D. Average run time decreases as the number of CPU cores on the indexers decreases.

正解: B

質問 62
......

合格させるSplunkはPassTest試験問題集：https://www.passtest.jp/Splunk/SPLK-2002-shiken.html

完全版最新のSPLK-2002問題集で100%カバー率問題と解答があなたをリアル試験で合格させる：https://drive.google.com/open?id=1RI7i7035SRqPyvbwhKjh8aSuu9fDQRBd

関するブログ

もっと

SPLK-2002 無料問題集