Splunk Architect Exam Study Guide questions with answers

Splunk Architect Exam Study Guide |\ |\ |\ |\ |\




questions with answers |\ |\




Which of the following statements are true regarding
|\ |\ |\ |\ |\ |\ |\ |\



multisite indexer clusters? |\ |\




A. Each site has its own set of peer nodes, but they all use
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\



the same search heads
|\ |\ |\ |\




B. Each site also obeys site-specific replication and search
|\ |\ |\ |\ |\ |\ |\ |\



factor rules
|\ |\




C. The cluster administrator defines the "sites"
|\ |\ |\ |\ |\ |\




D. B&C |\




E. All of the above
|\ |\ |\ |\




F. None of the above - CORRECT ANSWERS ✔✔D
|\ |\ |\ |\ |\ |\ |\ |\




_________ controls and manages index replication, as well
|\ |\ |\ |\ |\ |\ |\ |\



as distributes apps and configurations.
|\ |\ |\ |\




A. Deployment Server
|\ |\




B. Deployer Server
|\ |\




C. Master Node
|\ |\




D. Peer Nodes - CORRECT ANSWERS ✔✔C
|\ |\ |\ |\ |\ |\

,Peer nodes index data from inputs/forwarders and
|\ |\ |\ |\ |\ |\ |\



replicates data to other peer nodes as instructed by the
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



deployment server. |\




True or False? - CORRECT ANSWERS ✔✔False , (as
|\ |\ |\ |\ |\ |\ |\ |\ |\



instructed by Master Node) |\ |\ |\




Multisite clusters offer two key benefits: Disaster
|\ |\ |\ |\ |\ |\ |\



Recovery and Search Affinity. |\ |\ |\




True or False? - CORRECT ANSWERS ✔✔True
|\ |\ |\ |\ |\ |\




There can be only one Master Node, even in a multisite
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\ |\



cluster.


True or False? - CORRECT ANSWERS ✔✔True
|\ |\ |\ |\ |\ |\




Which of the following are true statements about how a
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



master node manages an index cluster?
|\ |\ |\ |\ |\




A. Coordinates the replicating activities of the peer nodes
|\ |\ |\ |\ |\ |\ |\ |\




B. Tells search heads where to find the data
|\ |\ |\ |\ |\ |\ |\ |\

,C. Orchestrates remedial activities if a peer becomes
|\ |\ |\ |\ |\ |\ |\ |\



unavailable
D. B&C|\




E. All of the above - CORRECT ANSWERS ✔✔E
|\ |\ |\ |\ |\ |\ |\ |\




The cluster will continue to operate while the Master Node
|\ |\ |\ |\ |\ |\ |\ |\ |\



is offline.
|\ |\




True or False? - CORRECT ANSWERS ✔✔True
|\ |\ |\ |\ |\ |\




Which of the following are true statements regarding
|\ |\ |\ |\ |\ |\ |\ |\



Replication Factor (RF)? (Select all that apply) |\ |\ |\ |\ |\ |\




A. Specifies how many copies will be searchable
|\ |\ |\ |\ |\ |\ |\




B. Specifies how many total copies of rawdata the cluster
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



can maintain
|\




C. Sets the total failure tolerance level
|\ |\ |\ |\ |\ |\




D. Determines how quickly you can recover the search
|\ |\ |\ |\ |\ |\ |\ |\ |\



capability - CORRECT ANSWERS ✔✔B C |\ |\ |\ |\ |\




Which of the following are true statements regarding
|\ |\ |\ |\ |\ |\ |\ |\



Search Factor (SF)? (Select all that apply)
|\ |\ |\ |\ |\ |\




A. Specifies how many copies will be searchable
|\ |\ |\ |\ |\ |\ |\

, B. Specifies how many total copies of rawdata the cluster
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\



can maintain |\




C. Sets the total failure tolerance level
|\ |\ |\ |\ |\ |\




D. Determines how quickly you can recover the search
|\ |\ |\ |\ |\ |\ |\ |\ |\



capability - CORRECT ANSWERS ✔✔A D |\ |\ |\ |\ |\




For indexer clustering, multisite mode requires at least __
|\ |\ |\ |\ |\ |\ |\ |\ |\



peer nodes per site in multisite mode.
|\ |\ |\ |\ |\ |\




A. 3 |\




B. 2 |\




C. 4 |\




D. 1 - CORRECT ANSWERS ✔✔B
|\ |\ |\ |\ |\




For indexer clustering, best practice for a single-site mode
|\ |\ |\ |\ |\ |\ |\ |\



is to have at least _______ nodes as a minimum.
|\ |\ |\ |\ |\ |\ |\ |\ |\ |\




A. RF+1
|\




B. RF+2
|\




C. SF+1
|\ |\




D. SF+2 - CORRECT ANSWERS ✔✔A
|\ |\ |\ |\ |\