Summer Special Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: dcdisc65

Page: 1 / 5
Total 48 questions
Exam Code: SPLK-2002                Update: Oct 15, 2025
Exam Name: Splunk Enterprise Certified Architect

Splunk Splunk Enterprise Certified Architect SPLK-2002 Exam Dumps: Updated Questions & Answers (October 2025)

Question # 1

A Splunk instance has the following settings in SPLUNK_HOME/etc/system/local/server.conf:

[clustering]

mode = master

replication_factor = 2

pass4SymmKey = password123

Which of the following statements describe this Splunk instance? (Select all that apply.)

A.

This is a multi-site cluster.

B.

This cluster's search factor is 2.

C.

This Splunk instance needs to be restarted.

D.

This instance is missing the master_uri attribute.

Question # 2

Which Splunk component is mandatory when implementing a search head cluster?

A.

Captain Server

B.

Deployer

C.

Cluster Manager

D.

RAFT Server

Question # 3

Which of the following should be done when installing Enterprise Security on a Search Head Cluster? (Select all that apply.)

A.

Install Enterprise Security on the deployer.

B.

Install Enterprise Security on a staging instance.

C.

Copy the Enterprise Security configurations to the deployer.

D.

Use the deployer to deploy Enterprise Security to the cluster members.

Question # 4

Users who receive a link to a search are receiving an "Unknown sid" error message when they open the link.

Why is this happening?

A.

The users have insufficient permissions.

B.

An add-on needs to be updated.

C.

The search job has expired.

D.

One or more indexers are down.

Question # 5

When should multiple search pipelines be enabled?

A.

Only if disk IOPS is at 800 or better.

B.

Only if there are fewer than twelve concurrent users.

C.

Only if running Splunk Enterprise version 6.6 or later.

D.

Only if CPU and memory resources are significantly under-utilized.

Question # 6

A search head has successfully joined a single site indexer cluster. Which command is used to configure the same search head to join another indexer cluster?

A.

splunk add cluster-config

B.

splunk add cluster-master

C.

splunk edit cluster-config

D.

splunk edit cluster-master

Question # 7

To activate replication for an index in an indexer cluster, what attribute must be configured in indexes.conf on all peer nodes?

A.

repFactor = 0

B.

replicate = 0

C.

repFactor = auto

D.

replicate = auto

Question # 8

Which tool(s) can be leveraged to diagnose connection problems between an indexer and forwarder? (Select all that apply.)

A.

telnet

B.

tcpdump

C.

splunk btool

D.

splunk btprobe

Question # 9

When adding or rejoining a member to a search head cluster, the following error is displayed:

Error pulling configurations from the search head cluster captain; consider performing a destructive configuration resync on this search head cluster member.

What corrective action should be taken?

A.

Restart the search head.

B.

Run the splunk apply shcluster-bundle command from the deployer.

C.

Run the clean raft command on all members of the search head cluster.

D.

Run the splunk resync shcluster-replicated-config command on this member.

Question # 10

Which of the following is true for indexer cluster knowledge bundles?

A.

Only app-name/local is pushed.

B.

app-name/default and app-name/local are merged before pushing.

C.

Only app-name/default is pushed.

D.

app-name/default and app-name/local are pushed without change.

Page: 1 / 5
Total 48 questions

Most Popular Certification Exams

Payment

       

Contact us

dumpscollection live chat

Site Secure

mcafee secure

TESTED 15 Oct 2025