A Splunk architect is gathering requirements for a new deployment. They have collected data on the number of users, daily ingest volume, and retention period. However, they forgot to document the existing network infrastructure and any firewall rules that might affect data ingestion. Which requirements gathering checklist item did they miss?

Functional and non-functional requirements

When estimating storage requirements for a Splunk deployment, which of the following must be considered?

The number of users who will have administrative access

The number of dashboards that will be created

The daily ingest rate and the retention period for the data

The type of search head hardware

During requirements gathering for a Splunk deployment, you interview the following stakeholders: a security analyst who needs to run complex searches, a SOC manager who needs to view dashboards, and a system administrator who will manage the Splunk environment. What is the best way to determine their access needs?

Give all users the same role with full permissions

Ask each stakeholder what they need to do in Splunk

Assume all users need the same level of access

Use the default Splunk roles without modification

Which of the following is an example of a user role that should be identified when gathering requirements for a Splunk deployment?

The network engineer who manages the firewall

The database administrator for the backend system

The Splunk administrator who manages indexes and users

The help desk technician who resets passwords

SplunkEnterprise Certified Architect

Domain 1Objective 1

Gather Requirements SPLK-2002 Practice Questions (Page 1)

Part of the Requirements and Infrastructure Planning domain, which makes up ~12% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–7 in this domain), expect 1–1 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

6concepts

Questions 1–5

1application · medium
A Splunk architect is gathering requirements for a new deployment. They have collected data on the number of users, daily ingest volume, and retention period. However, they forgot to document the existing network infrastructure and any firewall rules that might affect data ingestion. Which requirements gathering checklist item did they miss?
Select an answer first
2foundation · easy
When estimating storage requirements for a Splunk deployment, which of the following must be considered?
Select an answer first
3foundation · easy
A company expects to ingest 100 GB of data per day and needs to retain data for 90 days. What is the minimum raw storage needed for the indexed data, before accounting for replication or overhead?
Select an answer first
4application · medium
During requirements gathering for a Splunk deployment, you interview the following stakeholders: a security analyst who needs to run complex searches, a SOC manager who needs to view dashboards, and a system administrator who will manage the Splunk environment. What is the best way to determine their access needs?
Select an answer first
5foundation · easy
Which of the following is an example of a user role that should be identified when gathering requirements for a Splunk deployment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.

Gather Requirements SPLK-2002 Practice Questions (Page 1)

Questions 1–5

When estimating storage requirements for a Splunk deployment, which of the following must be considered?

A company expects to ingest 100 GB of data per day and needs to retain data for 90 days. What is the minimum raw storage needed for the indexed data, before accounting for replication or overhead?

Which of the following is an example of a user role that should be identified when gathering requirements for a Splunk deployment?

Keep studying — Requirements and Infrastructure Planning