An administrator is troubleshooting a deployment server that is not pushing apps to any clients. The deployment server's splunkd.log shows 'Connection from client rejected: Authentication failed' errors. The clients are configured with the correct deployment server URI. What is the most likely cause?

The deployment server's serverclass.conf is misconfigured.

The deployment server is not running.

The clients' firewall is blocking outbound traffic.

The clients are using a different password than the deployment server expects.

A universal forwarder is configured to send data to an indexer over SSL. The forwarder's splunkd.log shows 'SSL certificate validation failed' errors. The indexer's certificate is self-signed. The forwarder's outputs.conf has ssl = true and sslVerifyServerCert = true. What is the best action to resolve the issue while maintaining security?

Set ssl = false on the forwarder to use plaintext.

Set sslVerifyServerCert = false on the forwarder.

Restart the forwarder to clear the SSL cache.

Add the indexer's self-signed certificate to the forwarder's trust store.

A deployment client is not receiving apps from the deployment server. The client's splunkd.log shows 'Connection to deployment server failed' errors. The deployment server is running and reachable via ping. What should the administrator check next?

Restart the deployment server to refresh its listener.

Ensure the client has the forwarder app installed.

Verify the client's deploymentclient.conf has the correct server URI and port (e.g., 8089).

Check the deployment server's serverclass.conf for the correct client class.

A forwarder is dropping data during peak hours. The administrator checks the forwarder's metrics.log and sees 'output queue full' messages. The forwarder has plenty of CPU and memory. What is the most appropriate action to prevent data loss?

Switch the forwarder to a heavier forwarder to handle more load.

Increase the output queue size in outputs.conf and monitor for continued drops.

Reduce the number of inputs configured on the forwarder.

Disable the output queue to allow direct sending.

SplunkEnterprise Certified Architect

Domain 6Objective 4

Forwarding and Deployment SPLK-2002 Practice Questions (Page 3)

Part of the Troubleshooting domain, which makes up ~14% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

6concepts

Questions 11–15

11foundation · medium
A forwarder is not sending data to the indexer. Which log file should be examined first to identify connectivity or data flow issues?
Select an answer first
12expert · hard
An administrator is troubleshooting a deployment server that is not pushing apps to any clients. The deployment server's splunkd.log shows 'Connection from client rejected: Authentication failed' errors. The clients are configured with the correct deployment server URI. What is the most likely cause?
Select an answer first
13expert · hard
A universal forwarder is configured to send data to an indexer over SSL. The forwarder's splunkd.log shows 'SSL certificate validation failed' errors. The indexer's certificate is self-signed. The forwarder's outputs.conf has ssl = true and sslVerifyServerCert = true. What is the best action to resolve the issue while maintaining security?
Select an answer first
14application · medium
A deployment client is not receiving apps from the deployment server. The client's splunkd.log shows 'Connection to deployment server failed' errors. The deployment server is running and reachable via ping. What should the administrator check next?
Select an answer first
15application · medium
A forwarder is dropping data during peak hours. The administrator checks the forwarder's metrics.log and sees 'output queue full' messages. The forwarder has plenty of CPU and memory. What is the most appropriate action to prevent data loss?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.

Forwarding and Deployment SPLK-2002 Practice Questions (Page 3)

Questions 11–15

A forwarder is not sending data to the indexer. Which log file should be examined first to identify connectivity or data flow issues?

A deployment client is not receiving apps from the deployment server. The client's splunkd.log shows 'Connection to deployment server failed' errors. The deployment server is running and reachable via ping. What should the administrator check next?

A forwarder is dropping data during peak hours. The administrator checks the forwarder's metrics.log and sees 'output queue full' messages. The forwarder has plenty of CPU and memory. What is the most appropriate action to prevent data loss?

Keep studying — Troubleshooting