A Splunk admin has a search head cluster with a mix of versions. Some members are running an older version of Splunk, and the admin wants to push a configuration that uses a feature only available in the newer version. What should the admin do?

Push the configuration only to the members that support the new feature.

Upgrade all search head cluster members to the same version before pushing the configuration.

Push the configuration anyway; the deployer will handle version differences.

Use a deployment server to push the configuration only to the newer members.

Why should you avoid making direct configuration changes on search head cluster members?

Because search heads do not allow configuration changes

Because it causes the search head to restart automatically

Because the captain will reject any local changes

Because the deployer will overwrite them on the next push

Which practice is recommended when managing content with the deployer?

Store all configuration in the deployer's etc/system directory

Use version control to track changes to the configuration bundle

Edit configuration files directly on search head cluster members

Push configuration changes only during off-peak hours

In which scenario would you use a deployment server instead of a deployer?

To manage apps and configuration for a fleet of universal forwarders

To manage the captain's configuration in a search head cluster

To distribute apps to search heads in a cluster

To push a configuration bundle to all members of a search head cluster

SplunkCore Certified Consultant

Domain 9Objective 3

Describe Content Management Using the Deployer CORE-CERTIFIED-CONSULTANT Practice Questions (Page 2)

Part of the Search Head Clustering domain, which accounts for 10% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

6concepts

10%of the exam

Questions 6–10

6expert · hard
A Splunk admin has a search head cluster with a mix of versions. Some members are running an older version of Splunk, and the admin wants to push a configuration that uses a feature only available in the newer version. What should the admin do?
Select an answer first
7application · medium
A Splunk consultant is deploying a new search head cluster. The team wants to ensure that all members have the same set of apps and configuration, and that changes are made only from a central location. Which component should be designated as the central management point?
Select an answer first
8foundation · easy
Why should you avoid making direct configuration changes on search head cluster members?
Select an answer first
9foundation · easy
Which practice is recommended when managing content with the deployer?
Select an answer first
10foundation · easy
In which scenario would you use a deployment server instead of a deployer?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.