A forwarder is experiencing high CPU usage and is dropping data. The administrator checks the forwarder's metrics.log and sees 'indexer acknowledgement' failures. What is the most likely cause?

The indexer is not sending acknowledgements due to a high load, causing the forwarder to resend data and increase CPU.

The forwarder has too many inputs configured.

The forwarder's outputs.conf has useAck = false.

The forwarder's queue size is too small.

A deployment server is configured with multiple client classes. Some clients in class A receive apps, but clients in class B do not. Both classes are defined in serverclass.conf. The clients in class B show as 'connected' in the deployment server UI. What is the most likely cause?

The client class B has a machine name filter that doesn't match the clients' hostnames.

The deployment server is not restarting after config changes.

The clients in class B have a different version of Splunk that doesn't support deployment.

The apps for class B are not in the deployment server's apps directory.

A universal forwarder is configured to send data to an indexer, but no data is appearing in the index. The forwarder's splunkd.log shows 'Connection to indexer refused' errors. The indexer is listening on port 9997. What is the most likely cause?

The indexer's indexes.conf has the wrong default index.

The indexer's server.conf has ssl = true but the forwarder is not using SSL.

The forwarder's inputs.conf is not monitoring any files.

The forwarder's outputs.conf specifies the wrong port, such as 8089 instead of 9997.

A deployment client is not receiving an app that is defined in a server class. Which of the following is a likely cause?

The app is too large to deploy.

The client's operating system is not supported by the app.

The app is not included in the server class's app list.

The client is not in the same geographic location as the server.

SplunkEnterprise Certified Architect

Domain 6Objective 4

Forwarding and Deployment SPLK-2002 Practice Questions (Page 1)

Part of the Troubleshooting domain, which makes up ~14% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

6concepts

Questions 1–5

1application · medium
A forwarder is experiencing high CPU usage and is dropping data. The administrator checks the forwarder's metrics.log and sees 'indexer acknowledgement' failures. What is the most likely cause?
Select an answer first
2expert · hard
A deployment server is configured with multiple client classes. Some clients in class A receive apps, but clients in class B do not. Both classes are defined in serverclass.conf. The clients in class B show as 'connected' in the deployment server UI. What is the most likely cause?
Select an answer first
3application · medium
A universal forwarder is configured to send data to an indexer, but no data is appearing in the index. The forwarder's splunkd.log shows 'Connection to indexer refused' errors. The indexer is listening on port 9997. What is the most likely cause?
Select an answer first
4foundation · medium
A deployment client is not receiving an app that is defined in a server class. Which of the following is a likely cause?
Select an answer first
5foundation · medium
A deployment client is not receiving configurations from the deployment server. Which log file on the client should be checked to diagnose the connection issue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.