EMT Practice Test

1. Question Content...

---

Question1: Which of the following clarification steps should be taken if apps are not appearing on a deployment client?
(Select all that apply.)

Question2: To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?

Question3: Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

Question4: A customer plans to ingest 600 GB of data per day into Splunk. They will have six concurrent users, and they also want high data availability and high search performance. The customer is concerned about cost and wants to spend the minimum amount on the hardware for Splunk. How many indexers are recommended for this deployment?

Question5: What is the logical first step when starting a deployment plan?

Question6: Which of the following describe migration from single-site to multisite index replication?

Question7: Which command is used for thawing the archive bucket?

Question8: To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

Question9: The guidance Splunk gives for estimating size on for syslog data is 50% of original data size. How does this divide between files in the index?

Question10: What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?

Question11: What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

Question12: Which search head cluster component is responsible for pushing knowledge bundles to search peers, replicating configuration changes to search head cluster members, and scheduling jobs across the search head cluster?

Question13: Before users can use a KV store, an admin must create a collection. Where is a collection is defined?

Question14: Which of the following should be included in a deployment plan?

Question15: Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

Question16: Which Splunk server role regulates the functioning of indexer cluster?

Question17: Which of the following can a Splunk diag contain?

Question18: In a four site indexer cluster, which configuration stores two searchable copies at the origin site, one searchable copy at site2, and a total of four searchable copies?

Question19: Which command will permanently decommission a peer node operating in an indexer cluster?

Question20: In an existing Splunk environment, the new index buckets that are created each day are about half the size of the incoming data. Within each bucket, about 30% of the space is used for rawdata and about 70% for index files.
What additional information is needed to calculate the daily disk consumption, per indexer, if indexer clustering is implemented?

Question21: To improve Splunk performance, parallelIngestionPipelines setting can be adjusted on which of the following components in the Splunk architecture? (Select all that apply.)

Question22: When configuring a Splunk indexer cluster, what are the default values for replication and search factor?

Question23: What is the minimum reference server specification for a Splunk indexer?

Question24: Which of the following is a way to exclude search artifacts when creating a diag?

Question25: Which Splunk Enterprise offering has its own license?

Question26: When Splunk indexes data in a non clustered environment, what kind of files does it create by default?

Question27: Which of the following commands is used to clear the KV store?

Question28: When converting from a single-site to a multi-site cluster, what happens to existing single-site clustered buckets?

Question29: Which Splunk internal index contains license-related events?

Question30: Which of the following tasks should the architect perform when building a deployment plan? (Select all that apply.)

Question31: Of the following types of files within an index bucket, which file type may consume the most disk?

Question32: What is a Splunk Job? (Select all that apply.)

Question33: What is the algorithm used to determine captaincy in a Splunk search head cluster?

Question34: In a distributed environment, knowledge object bundles are replicated from the search head to which location on the search peer(s)?

Question35: Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?

Question36: When Splunk is installed, where are the internal indexes stored by default?

Question37: The KV store forms its own cluster within a SHC. What is the maximum number of SHC members KV store will form?

Question38: When adding or decommissioning a member from a Search Head Cluster (SHC), what is the proper order of operations?

Question39: A search head has successfully joined a single site indexer cluster. Which command is used to configure the same search head to join another indexer cluster?

Question40: When adding or rejoining a member to a search head cluster, the following error is displayed:
Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member.
What corrective action should be taken?