A search head cluster has 3 members. The captain is SHC1. The administrator needs to upgrade SHC1, which requires a reboot. The cluster has a critical scheduled search that runs every hour. The administrator wants to ensure the scheduled search runs without interruption. What is the best approach?

Run the scheduled search manually before rebooting SHC1.

Manually transfer captaincy to SHC2, verify the transfer, then reboot SHC1.

Reboot SHC1 and rely on automatic captaincy transfer.

Increase the number of cluster members before rebooting SHC1.

What triggers automatic captaincy transfer in a search head cluster?

The current captain becomes unresponsive or fails

A new search head is added to the cluster

The cluster reaches a certain search load threshold

The captain manually initiates a transfer

What is the primary purpose of transferring captaincy in a search head cluster?

To upgrade the search head cluster to a newer Splunk version

To change the replication factor of the search head cluster

To move the captain role to a different search head, typically for maintenance or to improve cluster performance

To permanently remove a search head from the cluster

A search head cluster has 4 members. The captain is SHC1. The administrator needs to perform maintenance on SHC1 that will take 2 hours. The cluster has a scheduled search that runs every 15 minutes. What is the best approach to minimize the impact on the scheduled search?

Let the cluster automatically elect a new captain when SHC1 goes offline.

Reboot SHC1 and immediately transfer captaincy to SHC2 after it comes back online.

Manually transfer captaincy to SHC2 before starting maintenance on SHC1.

Pause all scheduled searches for the duration of the maintenance.

A search head cluster has five members. The captain node suddenly loses network connectivity and becomes unresponsive. What happens to the cluster's scheduled searches and captaincy?

The cluster promotes the member with the highest uptime to captain, but scheduled searches are paused for 5 minutes.

The cluster pauses all scheduled searches until the original captain recovers.

The cluster shuts down because it has lost its captain.

The cluster elects a new captain from the remaining members, and scheduled searches continue on the new captain.

SplunkEnterprise Certified Architect

Domain 4Objective 4

Captaincy Transfer SPLK-2002 Practice Questions (Page 3)

Part of the Search Head Clustering and KV Store domain, which makes up ~19% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

Questions 11–15

11expert · medium
A search head cluster has 3 members. The captain is SHC1. The administrator needs to upgrade SHC1, which requires a reboot. The cluster has a critical scheduled search that runs every hour. The administrator wants to ensure the scheduled search runs without interruption. What is the best approach?
Select an answer first
12foundation · easy
What triggers automatic captaincy transfer in a search head cluster?
Select an answer first
13foundation · easy
What is the primary purpose of transferring captaincy in a search head cluster?
Select an answer first
14expert · medium
A search head cluster has 4 members. The captain is SHC1. The administrator needs to perform maintenance on SHC1 that will take 2 hours. The cluster has a scheduled search that runs every 15 minutes. What is the best approach to minimize the impact on the scheduled search?
Select an answer first
15application · medium
A search head cluster has five members. The captain node suddenly loses network connectivity and becomes unresponsive. What happens to the cluster's scheduled searches and captaincy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.