EMT Practice Test

1. Question Content...

---

Question1: A search head has successfully joined a single site indexer cluster. Which command is used to configure the same search head to join another indexer cluster?

Question2: A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master. How much data can the customer ingest before search is locked out?

Question3: Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?

Question4: To improve Splunk performance, parallelIngestionPipelines setting can be adjusted on which of the following components in the Splunk architecture? (Select all that apply.)

Question5: Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?

Question6: At which default interval does metrics.log generate a periodic report regarding license utilization?

Question7: In which phase of the Splunk Enterprise data pipeline are indexed extraction configurations processed?

Question8: In a distributed environment, knowledge object bundles are replicated from the search head to which location on the search peer(s)?

Question9: Which of the following clarification steps should be taken if apps are not appearing on a deployment client?
(Select all that apply.)

Question10: What is a Splunk Job? (Select all that apply.)

Question11: In the deployment planning process, when should a person identify who gets to see network data?

Question12: When Splunk indexes data in a non clustered environment, what kind of files does it create by default?

Question13: Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its capacity. Which of the following options will provide the most search performance improvement?

Question14: To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

Question15: A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

Question16: Which of the following is an indexer clustering requirement?

Question17: Which command will permanently decommission a peer node operating in an indexer cluster?

Question18: Which search head cluster component is responsible for pushing knowledge bundles to search peers, replicating configuration changes to search head cluster members, and scheduling jobs across the search head cluster?

Question19: What is the default log size for Splunk internal logs?

Question20: In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?