[2024年06月]更新のSPLK-2002試験問題集合格させるのは2024年最新のSplunk Enterprise Certified Architect
無料で使えるSPLK-2002試験問題集で合格させるお手軽に試験合格
質問 # 47
When using ingest-based licensing, what Splunk role requires the license manager to scale?
- A. Deployment clients
- B. Search heads
- C. There are no roles that require the license manager to scale
- D. Search peers
正解：C
解説：
When using ingest-based licensing, there are no Splunk roles that require the license manager to scale, because the license manager does not need to handle any additional load or complexity. Ingest-based licensing is a new licensing model that allows customers to pay for the data they ingest into Splunk, regardless of the data source, volume, or use case. Ingest-based licensing simplifies the licensing process and eliminates the need for license pools, license stacks, license slaves, and license warnings. The license manager is still responsible for enforcing the license quota and generating license usage reports, but it does not need to communicate with any other Splunk instances or monitor their license usage. Therefore, option C is the correct answer. Option A is incorrect because search peers are indexers that participate in a distributed search. They do not affect the license manager's scalability, because they do not report their license usage to the license manager. Option B is incorrect because search heads are Splunk instances that coordinate searches across multiple indexers. They do not affect the license manager's scalability, because they do not report their license usage to the license manager. Option D is incorrect because deployment clients are Splunk instances that receive configuration updates and apps from a deployment server. They do not affect the license manager's scalability, because they do not report their license usage to the license manager12
1: https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/AboutSplunklicensing 2:
https://docs.splunk.com/Documentation/Splunk/9.1.2/Admin/HowSplunklicensingworks
質問 # 48
When should a dedicated deployment server be used?
- A. When there are more than 50 apps to deploy to deployment clients.
- B. When there are more than 50 deployment clients.
- C. When there are more than 50 server classes.
- D. When there are more than 50 search peers.
正解：B
解説：
A dedicated deployment server is a Splunk instance that manages the distribution of configuration updates and apps to a set of deployment clients, such as forwarders, indexers, or search heads. A dedicated deployment server should be used when there are more than 50 deployment clients, because this number exceeds the recommended limit for a non-dedicated deployment server. A non-dedicated deployment server is a Splunk instance that also performs other roles, such as indexing or searching. Using a dedicated deployment server can improve the performance, scalability, and reliability of the deployment process. Option C is the correct answer. Option A is incorrect because the number of search peers does not affect the need for a dedicated deployment server. Search peers are indexers that participate in a distributed search. Option B is incorrect because the number of apps to deploy does not affect the need for a dedicated deployment server. Apps are packages of configurations and assets that provide specific functionality or views in Splunk. Option D is incorrect because the number of server classes does not affect the need for a dedicated deployment server. Server classes are logical groups of deployment clients that share the same configuration updates and apps12
1: https://docs.splunk.com/Documentation/Splunk/9.1.2/Updating/Aboutdeploymentserver 2:
https://docs.splunk.com/Documentation/Splunk/9.1.2/Updating/Whentousedeploymentserver
質問 # 49
In search head clustering, which of the following methods can you use to transfer captaincy to a different
member? (Select all that apply.)
- A. Run the splunk transfer shcluster-captaincommand from the current captain.
- B. Use the Search Head Clustering settings menu from Splunk Web on any member.
- C. Use the Monitoring Console.
- D. Run the splunk transfer shcluster-captaincommand from the member you would like to
become the captain.
正解：B、D
解説：
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/Transfercaptain
質問 # 50
In a distributed environment, knowledge object bundles are replicated from the search head to which location
on the search peer(s)?
- A. SPLUNK_HOME/var/lib/searchpeers
- B. SPLUNK_HOME/var/run/searchpeers
- C. SPLUNK_HOME/var/spool/searchpeers
- D. SPLUNK_HOME/var/log/searchpeers
正解：B
解説：
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/DistSearch/Whatsearchheadssend
質問 # 51
Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)
- A. Adding search heads provides additional CPU cores to run more concurrent searches.
- B. Adding search peers increases the search throughput as search load increases.
- C. Adding search peers increases the maximum size of search results.
- D. Adding RAM to an existing search heads provides additional search capacity.
正解：A、D
解説：
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Capacity/
HowsavedsearchesaffectSplunkEnterpriseperformance
質問 # 52
When configuring a Splunk indexer cluster, what are the default values for replication and search factor?
- A. replication_factor = 3search factor = 3
- B. replication_factor = 2search_factor = 2
- C. replication_factor = 3search_factor = 2
- D. replication_factor = 2search factor = 3
正解：C
解説：
Explanation
The replication factor and the search factor are two important settings for a Splunk indexer cluster. The replication factor determines how many copies of each bucket are maintained across the set of peer nodes. The search factor determines how many searchable copies of each bucket are maintained. The default values for both settings are 3, which means that each bucket has three copies, and at least one of them is searchable
質問 # 53
Which of the following are client filters available in serverclass.conf? (Select all that apply.)
- A. Platform (machine type).
- B. DNS name.
- C. IP address.
- D. Splunk server role.
正解：A、B、C
解説：
Explanation
The client filters available in serverclass.conf are DNS name, IP address, and platform (machine type). These filters allow the administrator to specify which forwarders belong to a server class and receive the apps and configurations from the deployment server. The Splunk server role is not a valid client filter in serverclass.conf, as it is not a property of the forwarder. For more information, see [Use forwarder management filters] in the Splunk documentation.
質問 # 54
Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?
- A. System default directory.
- B. App default directories, in ASCII order.
- C. System local directory.
- D. App local directories, in ASCII order.
正解：C
解説：
The system local directory has the highest precedence among the following directories that contain Splunk configuration files of the same name within different apps. Splunk configuration files are stored in various directories under the SPLUNK_HOME/etc directory. The precedence of these directories determines which configuration file settings take effect when there are conflicts or overlaps. The system local directory, which is located at SPLUNK_HOME/etc/system/local, has the highest precedence among all directories, because it contains the system-level configurations that are specific to the instance. The system default directory, which is located at SPLUNK_HOME/etc/system/default, has the lowest precedence among all directories, because it contains the system-level configurations that are provided by Splunk and should not be modified. The app local directories, which are located at SPLUNK_HOME/etc/apps/APP_NAME/local, have a higher precedence than the app default directories, which are located at SPLUNK_HOME/etc/apps/APP_NAME/default, because the local directories contain the app-level configurations that are specific to the instance, while the default directories contain the app-level configurations that are provided by the app and should not be modified. The app local and default directories have different precedences depending on the ASCII order of the app names, with the app names that come later in the ASCII order having higher precedences.
質問 # 55
When should multiple search pipelines be enabled?
- A. Only if there are fewer than twelve concurrent users.
- B. Only if running Splunk Enterprise version 6.6 or later.
- C. Only if CPU and memory resources are significantly under-utilized.
- D. Only if disk IOPS is at 800 or better.
正解：C
解説：
Explanation/Reference: https://answers.splunk.com/answers/617608/can-we-increase-parallelingestionpipelines-in-a-
he.html
質問 # 56
Which of the following are true statements about Splunk indexer clustering?
- A. The search head must run the same or a later Splunk version than the peer nodes.
- B. The master node must run the same or a later Splunk version than search heads.
- C. All peer nodes must run exactly the same Splunk version.
- D. The peer nodes must run the same or a later Splunk version than the master node.
正解：B
解説：
Explanation/Reference: https://answers.splunk.com/answers/760348/search-head-version-compatibility.html
質問 # 57
In the deployment planning process, when should a person identify who gets to see network data?
- A. Topology diagramming
- B. Data policy definition
- C. Data source inventory
- D. Deployment schedule
正解：B
解説：
Explanation
In the deployment planning process, a person should identify who gets to see network data in the data policy definition step. This step involves defining the data access policies and permissions for different users and roles in Splunk. The deployment schedule step involves defining the timeline and milestones for the deployment project. The topology diagramming step involves creating a visual representation of the Splunk architecture and components. The data source inventory step involves identifying and documenting the data sources and types that will be ingested by Splunk
質問 # 58
When Splunk indexes data in a non-clustered environment, what kind of files does it create by default?
- A. Rawdata and index files.
- B. Compressed and meta data files.
- C. Index and .tsidx files.
- D. Compressed and .tsidx files.
正解：C
解説：
When Splunk indexes data in a non-clustered environment, it creates index and .tsidx files by default. The index files contain the raw data that Splunk has ingested, compressed and encrypted. The .tsidx files contain the time-series index that maps the timestamps and event IDs of the raw data. The rawdata and index files are not the correct terms for the files that Splunk creates. The compressed and .tsidx files are partially correct, but compressed is not the proper name for the index files. The compressed and meta data files are also partially correct, but meta data is not the proper name for the .tsidx files.
質問 # 59
Of the following types of files within an index bucket, which file type may consume the most disk?
- A. Metadata (.data)
- B. Rawdata
- C. Bloom filter
- D. Inverted index (.tsidx)
正解：B
解説：
Of the following types of files within an index bucket, the rawdata file type may consume the most disk. The rawdata file type contains the compressed and encrypted raw data that Splunk has ingested. The rawdata file type is usually the largest file type in a bucket, because it stores the original data without any filtering or extraction. The bloom filter file type contains a probabilistic data structure that is used to determine if a bucket contains events that match a given search. The bloom filter file type is usually very small, because it only stores a bit array of hashes. The metadata (.data) file type contains information about the bucket properties, such as the earliest and latest event timestamps, the number of events, and the size of the bucket. The metadata file type is also usually very small, because it only stores a few lines of text. The inverted index (.tsidx) file type contains the time-series index that maps the timestamps and event IDs of the raw data. The inverted index file type can vary in size depending on the number and frequency of events, but it is usually smaller than the rawdata file type
質問 # 60
New data has been added to a monitor input file. However, searches only show older data.
Which splunkd. log channel would help troubleshoot this issue?
- A. ChunkedLBProcessor
- B. ArchiveProcessor
- C. Modularlnputs
- D. TailingProcessor
正解：D
解説：
The TailingProcessor channel in the splunkd.log file would help troubleshoot this issue, because it contains information about the files that Splunk monitors and indexes, such as the file path, size, modification time, and CRC checksum. It also logs any errors or warnings that occur during the file monitoring process, such as permission issues, file rotation, or file truncation. The TailingProcessor channel can help identify if Splunk is reading the new data from the monitor input file or not, and what might be causing the problem. Option B is the correct answer. Option A is incorrect because the ModularInputs channel logs information about the modular inputs that Splunk uses to collect data from external sources, such as scripts, APIs, or custom applications. It does not log information about the monitor input file. Option C is incorrect because the ChunkedLBProcessor channel logs information about the load balancing process that Splunk uses to distribute data among multiple indexers. It does not log information about the monitor input file. Option D is incorrect because the ArchiveProcessor channel logs information about the archive process that Splunk uses to move data from the hot/warm buckets to the cold/frozen buckets. It does not log information about the monitor input file12
1:
https://docs.splunk.com/Documentation/Splunk/9.1.2/Troubleshooting/WhatSplunklogsaboutitself#splunkd.log 2
https://docs.splunk.com/Documentation/Splunk/9.1.2/Troubleshooting/Didyouloseyourfishbucket#Check_the_sp
質問 # 61
Which CLI command converts a Splunk instance to a license slave?
- A. splunk edit licenser-localslave
- B. splunk add licenses
- C. splunk list licenser-slaves
- D. splunk list licenser-localslave
正解：A
解説：
The splunk edit licenser-localslave command is used to convert a Splunk instance to a license slave. This command will configure the Splunk instance to contact a license master and receive a license from it. This command should be used when the Splunk instance is part of a distributed deployment and needs to share a license pool with other instances. The splunk add licenses command is used to add a license to a Splunk instance, not to convert it to a license slave. The splunk list licenser-slaves command is used to list the license slaves that are connected to a license master, not to convert a Splunk instance to a license slave. The splunk list licenser-localslave command is used to list the license master that a license slave is connected to, not to convert a Splunk instance to a license slave. For more information, see Configure license slaves in the Splunk documentation.
質問 # 62
Which two sections can be expanded using the Search Job Inspector?
- A. Execution costs.
- B. Saved search history.
- C. Optimization suggestions.
- D. Search job properties.
正解：B、D
質問 # 63
Which of the following artifacts are included in a Splunk diagfile? (Select all that apply.)
- A. Customer data.
- B. Internal logs.
- C. OS settings.
- D. Configuration files.
正解：B、D
解説：
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Troubleshooting/Generateadiag
質問 # 64
Which command will permanently decommission a peer node operating in an indexer cluster?
- A. splunk stop -f
- B. splunk decommission --enforce counts
- C. splunk offline -f
- D. splunk offline --enforce-counts
正解：D
解説：
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Takeapeeroffline
質問 # 65
When troubleshooting monitor inputs, which command checks the status of the tailed files?
- A. curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:Tailstatus
- B. splunk cmd btool inputs list | tail
- C. curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus
- D. splunk cmd btool check inputs layer
正解：C
解説：
Explanation
The curl https://serverhost:8089/services/admin/inputstatus/TailingProcessor:FileStatus command is used to check the status of the tailed files when troubleshooting monitor inputs. Monitor inputs are inputs that monitor files or directories for new data and send the data to Splunk for indexing. The TailingProcessor:FileStatus endpoint returns information about the files that are being monitored by the Tailing Processor, such as the file name, path, size, position, and status. The splunk cmd btool inputs list | tail command is used to list the inputs configurations from the inputs.conf file and pipe the output to the tail command. The splunk cmd btool check inputs layer command is used to check the inputs configurations for syntax errors and layering. The curl
https://serverhost:8089/services/admin/inputstatus/TailingProcessor:Tailstatus command does not exist, and it is not a valid endpoint.
質問 # 66
To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?
- A. captain_is_adhoc_searchhead = true (on all members)
- B. adhoc_searchhead = true (on the current captain)
- C. captain_is_adhoc_searchhead = true (on the current captain)
- D. adhoc_searchhead = true (on all members)
正解：C
解説：
To reduce the captain's work load in a search head cluster, the setting that will prevent scheduled searches from running on the captain is captain_is_adhoc_searchhead = true (on the current captain). This setting will designate the current captain as an ad hoc search head, which means that it will not run any scheduled searches, but only ad hoc searches initiated by users. This will reduce the captain's work load and improve the search head cluster performance. The adhoc_searchhead = true (on all members) setting will designate all search head cluster members as ad hoc search heads, which means that none of them will run any scheduled searches, which is not desirable. The adhoc_searchhead = true (on the current captain) setting will have no effect, as this setting is ignored by the captain. The captain_is_adhoc_searchhead = true (on all members) setting will have no effect, as this setting is only applied to the current captain. For more information, see Configure the captain as an ad hoc search head in the Splunk documentation.
質問 # 67
A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)
- A. Directly edit SPLUNK_HOME/etc/system/default/server.conf
- B. Directly edit SPLUNK_HOME/etc/system/local/server.conf
- C. Run a splunk edit cluster-configcommand from the CLI.
- D. Via Splunk Web.
正解：B、D
解説：
Explanation/Reference: https://docs.splunk.com/Documentation/Splunk/7.3.2/Indexer/Enableclustersindetail
質問 # 68
Which of the following should be included in a deployment plan?
- A. Current and future topology diagrams of the IT environment.
- B. Current logging details and data source inventory.
- C. Business continuity and disaster recovery plans.
- D. A comprehensive list of stakeholders, either direct or indirect.
正解：A、B、C
解説：
A deployment plan should include business continuity and disaster recovery plans, current logging details and data source inventory, and current and future topology diagrams of the IT environment. These elements are essential for planning, designing, and implementing a Splunk deployment that meets the business and technical requirements. A comprehensive list of stakeholders, either direct or indirect, is not part of the deployment plan, but rather part of the project charter. For more information, see Deployment planning in the Splunk documentation.
質問 # 69
When using the props.conf LINE_BREAKERattribute to delimit multi-line events, the SHOULD_LINEMERGE
attribute should be set to what?
- A. True
- B. Auto
- C. False
- D. None
正解：A
解説：
Explanation/Reference: https://answers.splunk.com/answers/6926/how-to-keep-data-together-as-one-event.html
質問 # 70
In splunkd. log events written to the _internal index, which field identifies the specific log channel?
- A. channel
- B. sourcetype
- C. source
- D. component
正解：A
解説：
In the context of splunkd.log events written to the _internal index, the field that identifies the specific log channel is the "channel" field. This information is confirmed by the Splunk Common Information Model (CIM) documentation, where "channel" is listed as a field name associated with Splunk Audit Logs.
質問 # 71
What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?
- A. btool.log
- B. splunkd.log
- C. metrics.log
- D. tailing_processor.log
正解：D
解説：
Explanation
The tailing_processor.log file would be the best place to search if you suspect there is a problem interpreting a regular expression in a monitor stanza. This log file contains information about how Splunk monitors files and directories, including any errors or warnings related to parsing the monitor stanza. The splunkd.log file contains general information about the Splunk daemon, but it may not have the specific details about the monitor stanza. The btool.log file contains information about the configuration files, but it does not log the runtime behavior of the monitor stanza. The metrics.log file contains information about the performance metrics of Splunk, but it does not log the event breaking issues. For more information, see About Splunk Enterprise logging in the Splunk documentation.
質問 # 72
......
SPLK-2002試験問題集、SPLK-2002練習テスト問題：https://www.passtest.jp/Splunk/SPLK-2002-shiken.html
無料SPLK-2002学習ガイド試験問題と解答：https://drive.google.com/open?id=1RI7i7035SRqPyvbwhKjh8aSuu9fDQRBd