Splunk SPLK-2002 認定試験の出題範囲:
| トピック | 出題範囲 |
|---|
| トピック 1 | - Search Head Cluster: Targeted at the Enterprise Solutions Architect, this domain explores the architecture and configuration of search head clusters, necessary for scaling searches across large deployments.
|
| トピック 2 | - Clarifying the Problem: This section targets the Splunk Administrator and includes identifying relevant internal logs and indexes within Splunk. It supports accurate root cause analysis during troubleshooting.
|
| トピック 3 | - Search Problems: Aimed at the Splunk Administrator, this section explores challenges related to search performance and introduces the Job Inspector tool to investigate query-related problems.
|
| トピック 4 | - Indexer Cluster Management and Administration: This section assesses the Splunk Administrator’s skills in managing indexer clusters, including monitoring, peer management, app bundle handling, and storage utilisation strategies.
|
| トピック 5 | - Large-scale Splunk Deployment Overview: This domain measures the Enterprise Solutions Architect’s ability to design and manage Splunk server roles and configure license masters effectively in clustered environments.
|
| トピック 6 | - Infrastructure Planning: Index Design: Designed for the Enterprise Solutions Architect, this section addresses how to design and size indexes correctly. It also covers estimating storage requirements unrelated to smart store configurations and understanding relevant apps for deployment.
|
| トピック 7 | - KV Store Collection and Lookup Management: This final section measures skills of the Splunk Administrator in managing KV Store collections within clustered Splunk environments, supporting dynamic data storage and lookup functionalities.
|
| トピック 8 | - Clustering Overview: This section is intended for the Splunk Administrator and provides knowledge about search head clustering and related storage needs that are not smart store-specific. It introduces key concepts essential for managing clustered environments.
|
| トピック 9 | - Infrastructure Planning: Resource Planning: This domain assesses the expertise of the Enterprise Solutions Architect and deals with sizing considerations, hardware specifications, and storage needs for different Splunk components. It also considers security, privacy, and specialised sizing for apps like ES and ITSI.
|
| トピック 10 | - Project Requirements: This section evaluates the competencies of the Splunk Administrator and focuses on identifying environment-specific needs such as user volume and technical requirements. It includes the use of checklists and available resources to ensure all deployment needs are clearly understood.
|
| トピック 11 | - Deployment Problems: This section focuses on the Splunk Administrator and includes diagnosing issues related to data forwarding and deployment server operations.
|
| トピック 12 | - Licensing and Crash Problems: This section assesses the abilities of the Splunk Administrator to identify and resolve issues related to licensing limits and platform crashes during deployment and daily operations.
|
| トピック 13 | - Introduction: This section of the exam measures the skills of the Enterprise Solutions Architect and covers the foundational understanding of planning and executing a Splunk deployment. It introduces key concepts, including the definition of deployment plans and outlines the overall process.
|
| トピック 14 | - Forwarder and Deployment Best Practices: Aimed at the Splunk Administrator, this section covers best practices for designing the forwarder tier and managing Splunk components using deployment tools. It emphasises effective configuration management.
|
| トピック 15 | - Splunk Troubleshooting Methods and Tools: Designed for the Splunk Administrator, this domain provides understanding of available Splunk diagnostic tools and resources essential for identifying and resolving issues effectively.
|
参照:https://www.splunk.com/en_us/training/certification-track/splunk-enterprise-certified-architect.html
Splunk SPLK-2002 試験概要:
Splunk Enterprise Certified Architect 認定 SPLK-2002 試験問題:
問題 #1
Which of the following most improves KV Store resiliency?
A. Add faster storage to the search heads to improve artifact replication.
B. Decrease latency between search heads.
C. Add indexer CPU and memory to decrease search latency.
D. Increase the size of the Operations Log.
問題 #2
Indexing is slow and real-time search results are delayed in a Splunk environment with two indexers and one search head. There is ample CPU and memory available on the indexers. Which of the following is most likely to improve indexing performance?
A. Decrease the maximum concurrent scheduled searches in limits.conf
B. Increase the maximum number of hot buckets in indexes.conf
C. Increase the number of parallel ingestion pipelines in server.conf
D. Decrease the maximum size of the search pipelines in limits.conf
問題 #3
How does the average run time of all searches relate to the available CPU cores on the indexers?
A. Average run time increases as the number of CPU cores on the indexers decreases.
B. Average run time is independent of the number of CPU cores on the indexers.
C. Average run time decreases as the number of CPU cores on the indexers decreases.
D. Average run time increases as the number of CPU cores on the indexers increases.
問題 #4
Which Splunk cluster feature requires additional indexer storage?
A. Index Summarization
B. Indexer Acknowledgement
C. Search Head Clustering
D. Indexer Discovery
問題 #5
(Which deployer push mode should be used when pushing built-in apps?)
A. default only
B. merge_to_default
C. full
D. local_only
解説:
問題 #1 正解: B | 問題 #2 正解: C | 問題 #3 正解: A | 問題 #4 正解: A | 問題 #5 正解: D |