Articulate How to Manage and Deploy a Search Head Cluster CORE-CERTIFIED-CONSULTANT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An administrator notices that a search head cluster member is not receiving configuration updates from the deployer. Other members are receiving updates correctly. What is the most likely cause?

   • AThe captain is not forwarding the configuration to that member.
   • BThe deployer is not configured correctly.
   • CThe member has a different version of Splunk than the other members.
   • DThe member is not connected to the cluster or is experiencing network issues.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A search head cluster has five members. One member is scheduled for maintenance and will be offline for several hours. The administrator wants to ensure that the cluster remains fully operational during this time. What is the best approach?

   • AAdd a new member to the cluster to replace the one going offline.
   • BRemove the member from the cluster configuration before taking it offline.
   • CTake the member offline gracefully by stopping the Splunk service, and monitor the cluster to ensure the remaining members handle the load.
   • DRestart the captain before taking the member offline to ensure a stable leadership.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A search head cluster has been running for several months. The administrator notices that one member has a different version of an app than the other members. What is the most likely cause and how should it be resolved?

   • AThe captain is not replicating the app correctly. The administrator should restart the captain.
   • BConfiguration drift occurred because the member was manually modified. The administrator should re-apply the bundle from the deployer.
   • CThe member is not connected to the cluster. The administrator should check network connectivity.
   • DThe deployer is not functioning correctly. The administrator should restart the deployer.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which command is used on the deployer to push configuration changes to all search head cluster members?

   • Asplunk deploy shcluster
   • Bsplunk apply shcluster-bundle
   • Csplunk reload shcluster
   • Dsplunk push shcluster
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A consultant is troubleshooting a search head cluster where the deployer is not distributing the bundle to any members. The deployer is running and the `splunk apply shcluster-bundle` command completes without errors. What is the most likely cause?

   • AThe deployer is not configured with the correct cluster label or the members are not using the same label.
   • BThe members are not running the same version of Splunk as the deployer.
   • CThe deployer's shcluster/apps directory is empty.
   • DThe captain is not forwarding the bundle to the members.
   Reveal Solution Discussion Select an answer first