EMT Practice Test

1. Question Content...

---

Question1: As data enters the indexer, it proceeds through a pipeline where event processing occurs. In which pipeline does line breaking occur?

Question2: A new search head cluster is being implemented. Which is the correct command to initialize the deployer node without restarting the search head cluster peers?

Question3: A customer has downloaded the Splunk App for AWS from Splunkbase and installed it in a search head cluster following the instructions using the deployer. A power user modifies a dashboard in the app on one of the search head cluster members. The app containing an updated dashboard is upgraded to the latest version by following the instructions via the deployer.
What happens?

Question4: When monitoring and forwarding events collected from a file containing unstructured textual events, what is the difference in the Splunk2Splunk payload traffic sent between a universal forwarder (UF) and indexer compared to the Splunk2Splunk payload sent between a heavy forwarder (HF) and the indexer layer? (Assume that the file is being monitored locally on the forwarder.)

Question5: In addition to the normal responsibilities of a search head cluster captain, which of the following is a default behavior?

Question6: A customer has a number of inefficient regex replacement transforms being applied. When under heavy load the indexers are struggling to maintain the expected indexing rate. In a worst case scenario, which queue(s) would be expected to fill up?

Question7: Which of the following is the most efficient search?

Question8: Data can be onboarded using apps, Splunk Web, or the CLI.
Which is the PS preferred method?

Question9: A new single-site three indexer cluster is being stood up with replication_factor:2, search_factor:2. At which step would the Indexer Cluster be classed as 'Indexing Ready' and be able to ingest new data?
Step 1: Install and configure Cluster Master (CM)/Master Node with base clustering stanza settings, restarting CM.
Step 2: Configure a base app in etc/master-apps on the CM to enable a splunktcp input on port 9997 and deploy index creation configurations.
Step 3: Install and configure Indexer 1 so that once restarted, it contacts the CM, download the latest config bundle.
Step 4: Indexer 1 restarts and has successfully joined the cluster.
Step 5: Install and configure Indexer 2 so that once restarted, it contacts the CM, downloads the latest config bundle Step 6: Indexer 2 restarts and has successfully joined the cluster.
Step 7: Install and configure Indexer 3 so that once restarted, it contacts the CM, downloads the latest config bundle.
Step 8: Indexer 3 restarts and has successfully joined the cluster.

Question10: A [script://] input sends data to a Splunk forwarder using which method?

Question11: An index receives approximately 50GB of data per day per indexer at an even and consistent rate. The customer would like to keep this data searchable for a minimum of 30 days. In addition, they have hourly scheduled searches that process a week's worth of data and are quite sensitive to search performance.
Given ideal conditions (no restarts, nor drops/bursts in data volume), and following PS best practices, which of the following sets of indexes.conf settings can be leveraged to meet the requirements?

Question12: A customer wants to understand how Splunk bucket types (hot, warm, cold) impact search performance within their environment. Their indexers have a single storage device for all data. What is the proper message to communicate to the customer?

Question13: A customer has a new set of hardware to replace their aging indexers. What method would reduce the amount of bucket replication operations during the migration process?

Question14: A customer has been using Splunk for one year, utilizing a single/all-in-one instance. This single Splunk server is now struggling to cope with the daily ingest rate. Also, Splunk has become a vital system in day-to-day operations making high availability a consideration for the Splunk service. The customer is unsure how to design the new environment topology in order to provide this.
Which resource would help the customer gather the requirements for their new architecture?

Question15: A site from a multi-site indexer cluster needs to be decommissioned. Which of the following actions must be taken?

Question16: Which statement is correct?

Question17: A customer has a search cluster (SHC) of six members split evenly between two data centers (DC). The customer is concerned with network connectivity between the two DCs due to frequent outages. Which of the following is true as it relates to SHC resiliency when a network outage occurs between the two DCs?

Question18: What happens to the indexer cluster when the indexer Cluster Master (CM) runs out of disk space?

Question19: When setting up a multisite search head and indexer cluster, which nodes are required to declare site membership?

Question20: A customer is migrating their existing Splunk Indexer from an old set of hardware to a new set of indexers.
What is the earliest method to migrate the system?

Question21: When a bucket rolls from cold to frozen on a clustered indexer, which of the following scenarios occurs?

Question22: In which of the following scenarios should base configurations be used to provide consistent, repeatable, and supportable configurations?

Question23: Monitoring Console (MC) health check configuration items are stored in which configuration file?

Question24: The customer has an indexer cluster supporting a wide variety of search needs, including scheduled search, data model acceleration, and summary indexing. Here is an excerpt from the cluster mater's server.conf:

Which strategy represents the minimum and least disruptive change necessary to protect the searchability of the indexer cluster in case of indexer failure?

Question25: What is the default push mode for a search head cluster deployer app configuration bundle?

Question26: When setting up a multisite search head and indexer cluster, which nodes are required to declare site membership?

Question27: Where does the bloomfilter reside?

Question28: What happens when an index cluster peer freezes a bucket?

Question29: A customer wants to implement LDAP because managing local Splunk users is becoming too much of an overhead. What configuration details are needed from the customer to implement LDAP authentication?

Question30: A customer has a network device that transmits logs directly with UDP or TCP over SSL. Using PS best practices, which ingestion method should be used?