What happens when the deployer pushes a configuration bundle that contains errors?

The bundle is applied to all search heads, and the previous configuration is automatically restored

The bundle is applied only to the captain, which then replicates it to other members

The deployer rejects the bundle and does not push it to any search head

The bundle is applied to all search heads, and errors are logged for later review

A Splunk admin has made changes to a custom app on the deployer and wants to push it to a search head cluster. The admin is concerned about the impact on currently running searches. What should the admin do to minimize disruption?

Push the changes immediately, as the deployer automatically rolls back if any search fails.

Manually update each search head one by one to avoid any cluster-wide impact.

Disable the search head cluster temporarily, push the changes, then re-enable it.

Run the deployer push during a maintenance window when search activity is low.

A Splunk admin has made a mistake in a configuration file on the deployer and pushed it to the search head cluster, causing issues. The admin needs to revert to the previous working configuration. What is the most efficient way to do this?

Restart all search head members to clear the bad configuration.

Restore the previous version of the file from version control, then push again.

Use the cluster master to roll back the configuration.

Manually edit the file on each search head to fix the issue.

Where should an administrator place an app to be deployed to a search head cluster?

In the etc/apps directory on each search head

In the deployment server's etc/deployment-apps directory

In the etc/system directory on the captain

In the etc/shcluster directory on the deployer

SplunkCore Certified Consultant

Domain 9Objective 3

Describe Content Management Using the Deployer CORE-CERTIFIED-CONSULTANT Practice Questions (Page 4)

Part of the Search Head Clustering domain, which accounts for 10% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

6concepts

10%of the exam

Questions 16–19

16foundation · easy
What happens when the deployer pushes a configuration bundle that contains errors?
Select an answer first
17application · medium
A Splunk admin has made changes to a custom app on the deployer and wants to push it to a search head cluster. The admin is concerned about the impact on currently running searches. What should the admin do to minimize disruption?
Select an answer first
18application · medium
A Splunk admin has made a mistake in a configuration file on the deployer and pushed it to the search head cluster, causing issues. The admin needs to revert to the previous working configuration. What is the most efficient way to do this?
Select an answer first
19foundation · easy
Where should an administrator place an app to be deployed to a search head cluster?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.