A company has a Splunk deployment in a single data center. They want to add disaster recovery capabilities but have a limited budget. They have a recovery point objective (RPO) of 24 hours and a recovery time objective (RTO) of 48 hours. Which approach is most cost-effective while meeting these objectives?

Deploy a second indexer cluster at a second site with no replication.

Use forwarders to send data to a second site in real-time.

Implement multi-site indexer clustering with a second data center.

Perform daily backups of indexer data and store them in a different geographic location.

A Splunk consultant is advising a client on whether to implement high availability or disaster recovery. The client's main concern is losing access to Splunk for several days if a fire destroys their server room. Which approach should the consultant recommend?

Disaster recovery, because the scenario involves a major disruption that requires restoring operations from a remote location.

Neither, because Splunk cannot recover from a fire.

High availability, because it ensures the system is always available.

Both equally, because they are the same concept.

What is the purpose of search head clustering in a Splunk deployment?

To replicate indexed data across multiple data centers

To manage license usage across multiple Splunk instances

To forward data from forwarders to indexers

To provide high availability and load balancing for the search tier

A Splunk deployment uses indexer clustering with three peers. One peer becomes unavailable. What happens to data ingestion and search?

Data ingestion continues, but searches return incomplete results.

Data ingestion stops until the peer is restored.

Data ingestion continues, and searches continue to return results from the remaining peers.

Data ingestion continues, but search head must be restarted.

A Splunk deployment must tolerate the failure of a single indexer without interrupting search or indexing. Which approach is most appropriate?

Perform nightly backups of all indexes

Implement indexer clustering within a single site

Implement multi-site indexer clustering across two data centers

Use a single powerful indexer with redundant power supplies

SplunkCore Certified Consultant

Domain 1Objective 3

Explain the Difference Between High Availability and Disaster Recovery and How Both Can Be Addressed in Splunk CORE-CERTIFIED-CONSULTANT Practice Questions (Page 2)

Part of the Deploying Splunk domain, which accounts for 5% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~3–4 in this domain), expect 1–1 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

6concepts

5%of the exam

Questions 6–10

6expert · hard
A company has a Splunk deployment in a single data center. They want to add disaster recovery capabilities but have a limited budget. They have a recovery point objective (RPO) of 24 hours and a recovery time objective (RTO) of 48 hours. Which approach is most cost-effective while meeting these objectives?
Select an answer first
7application · medium
A Splunk consultant is advising a client on whether to implement high availability or disaster recovery. The client's main concern is losing access to Splunk for several days if a fire destroys their server room. Which approach should the consultant recommend?
Select an answer first
8foundation · easy
What is the purpose of search head clustering in a Splunk deployment?
Select an answer first
9application · medium
A Splunk deployment uses indexer clustering with three peers. One peer becomes unavailable. What happens to data ingestion and search?
Select an answer first
10foundation · easy
A Splunk deployment must tolerate the failure of a single indexer without interrupting search or indexing. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.