Splunk Enterprise Certified Architect (SPLK-2002) practice questions

Exam overview SPLK-2002

Domain coverage 20 domains

• Introduction (2%)
• Project Requirements (5%)
• Infrastructure Planning — Index Design (5%)
• Infrastructure Planning — Resource Planning (7%)
• Clustering Overview (5%)
• Forwarder and Deployment Best Practices (6%)
• Performance Monitoring and Tuning (5%)
• Splunk Troubleshooting Methods and Tools (5%)
• Clarifying the Problem (5%)
• Licensing and Crash Problems (5%)
• Configuration Problems (5%)
• Search Problems (5%)
• Deployment Problems (5%)
• Large-scale Splunk Deployment Overview (5%)
• Single-site Indexer Cluster (5%)
• Multisite Indexer Cluster (5%)
• Indexer Cluster Management & Admin (7%)
• Search Head Cluster (5%)
• Search Head Cluster Management & Admin (5%)
• KV Store Collection & Lookup Management (3%)

Sample questions 13 of 125 shown

1. Q1 Introduction (2%)

   Which of the following should be included in a deployment plan?

   1. A list of all vendor software licenses
   2. A comprehensive list of stakeholders, either direct or indirect
   3. The complete source code of all custom apps
   4. The personal contact information of all end users

   A deployment plan should include a comprehensive list of stakeholders, either direct or indirect, who will be affected by or have input into the Splunk deployment. This ensures proper communication, requirement gathering, and alignment with business objectives throughout the deployment process.
2. Q2 Introduction (2%)

   In the deployment planning process, when should a person identify who gets to see network data?

   1. Deployment schedule
   2. Topology diagramming
   3. Data source inventory
   4. Data policy definition

   Identifying who gets to see network data should occur during the data policy definition phase of deployment planning. Data policy definition involves establishing rules about data access, retention, and security, including determining which users or roles have permission to view specific types of data such as network data.
3. Q3 Introduction (2%)

   Describe a deployment plan in the context of a Splunk Enterprise implementation.

   1. A list of hardware specifications required for the deployment
   2. A comprehensive document outlining the strategy, timeline, resources, and processes for implementing Splunk Enterprise
   3. A configuration file that defines indexer cluster settings
   4. A training schedule for end users of the Splunk platform

   A deployment plan in the context of Splunk Enterprise is a comprehensive document that outlines the strategy, timeline, resources, and processes required to implement a Splunk deployment successfully. It covers stakeholder identification, requirement gathering, infrastructure planning, data source onboarding, configuration management, and operational considerations.
4. Q4 Project Requirements (5%)

   What information is needed about the current environment before deploying Splunk? (Select all that apply.)

   1. List of vendors for network devices
   2. Overall goals for the deployment
   3. Key users
   4. Data sources

   Before deploying Splunk, it is essential to understand the overall goals for the deployment, identify key users who will interact with the system, and catalog all data sources that will feed into Splunk. Knowing the list of vendors for network devices is less critical than understanding the business objectives, user base, and data inputs that will drive the deployment architecture and sizing.
5. Q5 Project Requirements (5%)

   When planning user management for a new Splunk deployment, which task can be disregarded?

   1. Determine the number of users present in Splunk log events
   2. Identify users authenticating with Splunk using LDAP or SAML
   3. Identify users authenticating with Splunk native authentication
   4. Determine the capabilities users need within the Splunk environment

   Determining the number of users present in Splunk log events is not a relevant task for user management planning. The focus should be on identifying authentication methods (LDAP, SAML, or native), and determining the capabilities and roles users need within the Splunk environment.
6. Q6 Project Requirements (5%)

   Identify critical information about the environment, volume, users, and requirements during the project requirements phase.

   1. The brand of network switches in use
   2. Daily data ingestion volume, number of users, search types, and data retention requirements
   3. The version of the operating system on end-user workstations
   4. The office locations of all stakeholders

   During the project requirements phase, it is critical to gather information about daily data ingestion volume (affects licensing and storage), number of users (affects search head capacity), types of searches (affects performance planning), and data retention requirements (affects storage sizing and index design).
7. Q7 Project Requirements (5%)

   Which of the following should be identified during the project requirements gathering phase for a Splunk deployment?

   1. The specific make and model of servers to be used
   2. The data sources, volume estimates, user count, and use cases
   3. The brand of monitoring software currently in use
   4. The color scheme of the Splunk Web interface

   During project requirements gathering, key items to identify include data sources (what data will be ingested), volume estimates (how much data per day), user count (how many people will search), and use cases (security, IT operations, business analytics). These factors directly influence the architecture and sizing of the Splunk deployment.
8. Q8 Project Requirements (5%)

   A company is planning a new Splunk Enterprise deployment. Which requirement is MOST important to determine the appropriate license type?

   1. Number of concurrent users
   2. Daily ingest volume in GB
   3. Number of indexers
   4. Types of data sources

   Splunk licensing is based on daily indexing volume measured in gigabytes (GB). The daily ingest volume is the single most important factor in determining the appropriate license type and size. While other factors like user count and data sources are relevant for architecture planning, the license is directly tied to indexing volume.
9. Q9 Project Requirements (5%)

   During the project requirements phase, which checklists and resources should be used to aid in collecting requirements?

   1. The Splunk Deployment Methodology checklist and capacity planning worksheets
   2. The MySQL administration guide
   3. The network topology diagram from the IT department
   4. The annual budget report

   Splunk provides a Deployment Methodology that includes checklists and capacity planning worksheets to help collect deployment requirements. These resources guide architects through a systematic process of gathering information about data sources, volume, users, search types, retention policies, and infrastructure needs.
10. Q10 Infrastructure Planning: Index Design (5%)

    When designing the number and size of indexes, which of the following considerations should be applied?

    1. Expected daily ingest volume, access controls, number of concurrent users
    2. Number of installed apps, expected daily ingest volume, data retention time policies
    3. Data retention time policies, number of installed apps, access controls
    4. Expected daily ingest volumes, data retention time policies, access controls

    When designing the number and size of indexes, the key considerations are expected daily ingest volumes (determining storage sizing), data retention time policies (determining how long data is kept), and access controls (determining who can access specific indexed data). The number of concurrent users is more relevant to search head sizing, not index design.
11. Q11 Infrastructure Planning: Index Design (5%)

    The guidance Splunk gives for estimating size on disk for syslog data is 50% of original data size. How does this divide between files in the index?

    1. rawdata is: 15%, tsidx is: 35%
    2. rawdata is: 35%, tsidx is: 15%
    3. rawdata is: 25%, tsidx is: 25%
    4. rawdata is: 10%, tsidx is: 40%

    For syslog data, Splunk estimates that the on-disk storage is approximately 50% of the original data size. Within the index buckets, the rawdata consumes about 15% and the tsidx (index files) consumes about 35% of the original data size. This distribution is important for storage capacity planning.
12. Q12 Infrastructure Planning: Index Design (5%)

    What is the expected minimum amount of storage required for data across an indexer cluster with the following input and parameters?

    • Raw data = 15 GB per day
    • Index files = 35 GB per day
    • Replication Factor (RF) = 2
    • Search Factor (SF) = 2

    1. 85 GB per day
    2. 50 GB per day
    3. 100 GB per day
    4. 65 GB per day

    Total indexed data per day = Raw data (15 GB) + Index files (35 GB) = 50 GB. With RF = 2, each bucket is stored twice: 50 GB × 2 = 100 GB. SF = 2 means two searchable copies, but since RF ≥ SF, the replication copies already account for searchable copies. Total = 50 GB × RF(2) = 100 GB per day.
13. Q13 Infrastructure Planning: Index Design (5%)

    Understand the design and sizing of indexes. Which factor determines the maximum number of buckets per index?

    1. The maxTotalDataSizeMB setting in indexes.conf
    2. The number of CPU cores on the indexer
    3. The amount of RAM allocated to Splunk
    4. The network bandwidth between indexers

    The maxTotalDataSizeMB setting in indexes.conf determines the maximum total size of an index. When this size is reached, the oldest buckets are frozen (archived or deleted) based on the frozenTimePeriodInSecs setting. This is the primary mechanism for controlling the size and number of buckets per index.

Answer all 125 questions with instant feedback →

Reader reviews 158 ratings

• I was struggling with SPLK-2002 until I found this. The domain-based organization and instant feedback helped me identify weak areas quickly.

  ★★★★★★ David L.

• The progress tracking feature for SPLK-2002 really motivated me. Seeing my improvement over time was incredibly satisfying.

  ★★★★★★ Daniel H.

• I bought the SPLK-2002 question bank a week before my exam and passed with 90%+. The questions are that good.

  ★★★★★ Maria V.

• Was on the fence about buying the SPLK-2002 practice test, but man am I glad I did. Nailed my certification today.

  ★★★★★ Tyler M.

• Couldn’t have passed the SPLK-2002 exam without this. The questions are challenging, the explanations are thorough, and the value is unbeatable.

  ★★★★★ Hannah L.

• Only used this for a week before my SPLK-2002 exam and it was enough. Questions are very close to the real deal.

  ★★★★★★ Katherine W.

Frequently asked questions

More Splunk exams