Splunk SPLK-2002 Actual Free Exam Questions & Community Discussion

Exam Code/Number: SPLK-2002
Exam Name/Title: Splunk Enterprise Certified Architect
Certification Provider: Splunk
Corresponding Certification: Splunk Enterprise Certified Architect

Exam Questions: 207
Updated On: Jul 02, 2026

Question #10

Which of the following is true for indexer cluster knowledge bundles?

A. app-name/default and app-name/local are pushed without change.

B. Only app-name/default is pushed.

C. app-name/default and app-name/local are merged before pushing.

D. Only app-name/local is pushed.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #11

A customer has installed a 500GB Enterprise license. They also purchased and installed a 300GB, no enforcement license on the same license master. How much data can the customer ingest before the search is locked out?

A. 800GB. After this limit, the search is locked out.

B. 300GB. After this limit, the search is locked out.

C. Search is not locked out. Violations are still recorded.

D. 500GB. After this limit, the search is locked out.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #12

The frequency in which a deployment client contacts the deployment server is controlled by what?

A. polling_interval attribute in deploymentclient.conf

B. phoneHomeIntervalInSecs attribute in deploymentclient.conf

C. polling_interval attribute in outputs.conf

D. phoneHomeIntervalInSecs attribute in outputs.conf

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #13

What is the minimum reference server specification for a Splunk indexer?

A. 12 CPU cores, 12GB RAM, 800 IOPS

B. 16 CPU cores, 16GB RAM, 800 IOPS

C. 24 CPU cores, 16GB RAM, 1200 IOPS

D. 28 CPU cores, 32GB RAM, 1200 IOPS

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #14

Which of the following should be included in a deployment plan?

A. Current and future topology diagrams of the IT environment.

B. Business continuity and disaster recovery plans.

C. Current logging details and data source inventory.

D. A comprehensive list of stakeholders, either direct or indirect.

Discussion 0

Correct Answer: A,B,C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #15

In a clustered environment, where should the Splunk Monitoring Console be deployed?

A. On the Cluster Manager to ensure proper access to the indexer cluster.

B. On a separate server with access to all non-forwarder Splunk servers.

C. On a separate server with access to the Search Heads and Indexers only.

D. On each instance running in standalone mode.

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #16

(Based on the data sizing and retention parameters listed below, which of the following will correctly calculate the index storage required?)
* Daily rate = 20 GB / day
* Compress factor = 0.5
* Retention period = 30 days
* Padding = 100 GB

A. (20 * 30 + 100) * 0.5 = 350 GB

B. 20 / 0.5 * 30 + 100 = 1300 GB

C. 20 * 0.5 * 30 + 100 = 400 GB

D. 20 * 30 + 100 = 700 GB

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #17

Which of the following are client filters available in serverclass.conf? (Select all that apply.)

A. IP address.

B. DNS name.

C. Platform (machine type).

D. Splunk server role.

Discussion 0

Correct Answer: A,B,C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #18

When converting from a single-site to a multi-site cluster, what happens to existing single-site clustered buckets?

A. They will be replicated across all peers in the multi-site cluster and age out based on existing policies.

B. They will continue to replicate within the origin site and age out based on existing policies.

C. They will stop replicating within the single-site and remain on the indexer they reside on and age out according to existing policies.

D. They will maintain replication as required according to the single-site policies, but never age out.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Download Free Splunk SPLK-2002 Demo

Simply submit your e-mail address below to get started with our free demo of your Splunk SPLK-2002 exam.