An administrator is performing a rolling upgrade of a 6-node indexer cluster. After upgrading the third peer, they notice that the peer is failing to rejoin the cluster and is generating errors. What is the most appropriate immediate action?

Roll back the single failing peer to the previous version and restore it to the cluster, then investigate the cause of the failure.

Continue upgrading the remaining peers, hoping the issue resolves itself.

Roll back the entire cluster to the previous version immediately.

Remove the failing peer from the cluster and continue the upgrade with the remaining peers.

When is a downtime upgrade of an indexer cluster appropriate?

When the cluster has only one peer node

When the cluster must remain available for search at all times

When the maintenance window allows for a full cluster shutdown

When there are multiple search heads that need to be upgraded

A small organization with a 2-node indexer cluster (replication factor 2) needs to upgrade from Splunk 8.2 to 9.0. They have a 2-hour maintenance window and can accept complete downtime. What is the most appropriate upgrade method?

Upgrade the cluster master first, then upgrade both peers simultaneously while they are still running.

Add a third peer to the cluster, perform a rolling upgrade, and then remove the third peer.

Perform a rolling upgrade, upgrading one peer at a time.

Perform a downtime upgrade by stopping both peers, upgrading them, and restarting them.

After upgrading an indexer cluster, which of the following should be checked to verify cluster health?

The search heads are running the same version as the indexers

The cluster master's dashboard shows all peers as connected and replication is up to date

The cluster master has been restarted at least once

All peers have the same amount of free disk space

An administrator is planning a downtime upgrade of a 3-node indexer cluster from Splunk 8.1 to 8.2. The cluster has a replication factor of 2. What is a critical prerequisite that must be checked before the upgrade begins?

Ensure that the license master is upgraded to version 8.2 before the indexer cluster.

Confirm that all buckets are replicated according to the replication factor and that there are no down peers.

Ensure that all search heads are also upgraded to version 8.2 before the indexer cluster.

Verify that the cluster master is running the latest version and all peers are in sync with it.

SplunkEnterprise Certified Architect

Domain 3Objective 4

Cluster Migration and Upgrade Considerations SPLK-2002 Practice Questions (Page 3)

Part of the Indexer Clustering domain, which makes up ~25% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~9–15 in this domain), expect 1–2 from this objective — we provide 20 practice questions to prepare you well beyond it. (estimate)

20questions here

4free pages

6concepts

Questions 11–15

11application · medium
An administrator is performing a rolling upgrade of a 6-node indexer cluster. After upgrading the third peer, they notice that the peer is failing to rejoin the cluster and is generating errors. What is the most appropriate immediate action?
Select an answer first
12foundation · easy
When is a downtime upgrade of an indexer cluster appropriate?
Select an answer first
13application · medium
A small organization with a 2-node indexer cluster (replication factor 2) needs to upgrade from Splunk 8.2 to 9.0. They have a 2-hour maintenance window and can accept complete downtime. What is the most appropriate upgrade method?
Select an answer first
14foundation · easy
After upgrading an indexer cluster, which of the following should be checked to verify cluster health?
Select an answer first
15application · medium
An administrator is planning a downtime upgrade of a 3-node indexer cluster from Splunk 8.1 to 8.2. The cluster has a replication factor of 2. What is a critical prerequisite that must be checked before the upgrade begins?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.