SplunkEnterprise Certified Architect
Domain 6Objective 4
Forwarding and Deployment SPLK-2002 Practice Questions (Page 2)
Part of the Troubleshooting domain, which makes up ~14% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)
21questions here
5free pages
6concepts
Questions 6–10
- 6
A Splunk administrator notices that a group of forwarders stopped sending data to the indexer cluster after a network team changed firewall rules. The forwarders' splunkd.log shows repeated 'TcpOutputProc' connection refused errors to the indexer's IP on port 9997. The indexer is healthy and listening on 9997. What should the administrator do first?
Select an answer first - 7
Which configuration file on the deployment server defines server classes and their associated apps?
Select an answer first - 8
A deployment server is configured to push an app to a client class, but some clients in that class are not receiving the app. The clients show as 'connected' in the deployment server UI. What is the most likely cause?
Select an answer first - 9
Which Splunk monitoring tool provides a real-time view of forwarder performance, including queue sizes and throughput?
Select an answer first - 10
A deployment client is failing to connect to the deployment server. The administrator verifies that the deployment server is running and the client can reach it via ping. The client's deploymentclient.conf has the correct server URI. What should the administrator check next?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.