EMT Practice Test

1. Question Content...

---

Question1: Which of the following is true regarding Splunk Enterprise's performance? (Select all that apply.)

Question2: Which Splunk server role regulates the functioning of indexer cluster?

Question3: Which of the following is an indexer clustering requirement?

Question4: Which of the following statements describe licensing in a clustered Splunk deployment? (Select all that apply.)

Question5: Which Splunk internal index contains license-related events?

Question6: When should multiple search pipelines be enabled?

Question7: What log file would you search to verify if you suspect there is a problem interpreting a regular expression in a monitor stanza?

Question8: In a distributed environment, knowledge object bundles are replicated from the search head to which location on the search peer(s)?

Question9: Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)

Question10: What is the algorithm used to determine captaincy in a Splunk search head cluster?

Question11: To reduce the captain's work load in a search head cluster, what setting will prevent scheduled searches from running on the captain?

Question12: Which of the following is a best practice to maximize indexing performance?

Question13: In search head clustering, which of the following methods can you use to transfer captaincy to a different member? (Select all that apply.)

Question14: Stakeholders have identified high availability for searchable data as their top priority. Which of the following best addresses this requirement?

Question15: The frequency in which a deployment client contacts the deployment server is controlled by what?

Question16: Because Splunk indexing is read/write intensive, it is important to select the appropriate disk storage solution for each deployment. Which of the following statements is accurate about disk storage?

Question17: Which of the following statements describe a Search Head Cluster (SHC) captain? (Select all that apply.)

Question18: The KV store forms its own cluster within a SHC. What is the maximum number of SHC members KV store will form?

Question19: Which of the following commands is used to clear the KV store?

Question20: Which search head cluster component is responsible for pushing knowledge bundles to search peers, replicating configuration changes to search head cluster members, and scheduling jobs across the search head cluster?

Question21: When converting from a single-site to a multi-site cluster, what happens to existing single-site clustered buckets?

Question22: Which of the following security options must be explicitly configured (i.e. which options are not enabled by default)?

Question23: Consider a use case involving firewall data. There is no Splunk-supported Technical Add-On, but the vendor has built one. What are the items that must be evaluated before installing the add-on? (Select all that apply.)

Question24: Which of the following will cause the greatest reduction in disk size requirements for a cluster of N indexers running Splunk Enterprise Security?

Question25: Which of the following tasks should the architect perform when building a deployment plan? (Select all that apply.)

Question26: Which of the following can a Splunk diag contain?

Question27: A Splunk instance has the following settings in SPLUNK_HOME/etc/system/local/server.conf:
[clustering]
mode = master
replication_factor = 2
pass4SymmKey = password123
Which of the following statements describe this Splunk instance? (Select all that apply.)

Question28: Which search will show all deployment client messages from the client (UF)?

Question29: When adding or rejoining a member to a search head cluster, the following error is displayed:
Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member.
What corrective action should be taken?

Question30: What is the default log size for Splunk internal logs?

Question31: To optimize the distribution of primary buckets; when does primary rebalancing automatically occur? (Select all that apply.)

Question32: Which of the following describe migration from single-site to multisite index replication?

Question33: When Splunk indexes data in a non-clustered environment, what kind of files does it create by default?

Question34: In search head clustering, which of the following methods can you use to transfer captaincy to a different member? (Select all that apply.)

Question35: Which of the following should be included in a deployment plan?

Question36: A multi-site indexer cluster can be configured using which of the following? (Select all that apply.)

Question37: What is the minimum reference server specification for a Splunk indexer?