Explain the Difference Between High Availability and Disaster Recovery and How Both Can Be Addressed in Splunk CORE-CERTIFIED-CONSULTANT Practice Questions (Page 5)

Questions 21–22

1. 21application · medium

   A Splunk administrator is planning a deployment for a company that requires high availability for indexing but can tolerate a brief interruption in search during a failover. Which combination of features should they use?

   • ASearch head clustering with a single indexer.
   • BA single indexer and a single search head with no clustering.
   • CIndexer clustering with a single site and a standalone search head.
   • DMulti-site indexer clustering with no search head cluster.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company runs a Splunk deployment in a single data center. They want to protect against a regional outage while minimizing additional infrastructure cost. They have a recovery point objective (RPO) of 1 hour and a recovery time objective (RTO) of 4 hours. Which approach should they choose?

   • ADeploy a second standalone indexer at the second site and replicate data using forwarders.
   • BConfigure multi-site indexer clustering with a second site and use search head clustering across sites.
   • CPerform hourly backups of indexer data and ship them to a second site.
   • DUse indexer clustering within the single data center and rely on manual recovery procedures.
   Reveal Solution Discussion Select an answer first