Question 1

As of Splunk 9.0, which index records changes to . conf files?

Options :

A : _configtracker

B : _introspection

C : _internal

D : _audit

Answer: A

Question 2

What does the deployer do in a Search Head Cluster (SHC)? (Select all that apply.)

Options :

A :

Distributes apps to SHC members.

B :

Bootstraps a clean Splunk install for a SHC.

C : Distributes non-search related and manual configuration file changes.

D : Distributes runtime knowledge object changes made by users across the SHC.

Answer: A

Question 3

What is the minimum reference server specification for a Splunk indexer?

Options :

A : 12 CPU cores, 12GB RAM, 800 IOPS

B :

16 CPU cores, 16GB RAM, 800 IOPS

C : 24 CPU cores, 16GB RAM, 1200 IOPS

D : 28 CPU cores, 32GB RAM, 1200 IOPS

Answer: A

Question 4

When configuring a Splunk indexer cluster, what are the default values for replication and search factor?

Options :

A :

replication_factor = 2search_factor = 2

B : replication_factor = 2search factor = 3

C :

replication_factor = 3search_factor = 2

D :

replication_factor = 3search factor = 3

Answer: C

Question 5

What does setting site=site0 on all Search Head Cluster members do in a multi-site indexer cluster?

Options :

A : Disables search site affinity.

B : Sets all members to dynamic captaincy.

C : Enables multisite search artifact replication.

D : Enables automatic search site affinity discovery.

Answer: A