A Splunk architect is gathering requirements for a deployment. The stakeholders have conflicting requirements: they want real-time search on all data, but they also want to minimize hardware costs. Which of the following is the best approach to reconcile these requirements?

Use a larger indexer cluster to handle real-time search

Use a smaller retention period to reduce storage costs

Discuss the trade-offs with stakeholders and find a balance

Ignore the cost constraint and focus on real-time search

When profiling user roles for a Splunk deployment, which of the following is a key factor to identify?

The IP addresses of the users' workstations

The types of searches each user role will perform

The operating system of the users' laptops

The physical location of the users' desks

Which of the following is an example of a non-functional requirement for a Splunk deployment?

The ability to search across multiple data sources

The system must be available 99.9% of the time

The ability to create and share dashboards

The ability to set up alerts for specific conditions

A Splunk architect is using a requirements gathering checklist. They have documented the number of users, daily ingest volume, and retention period. However, they have not documented the existing network infrastructure. Why is this a problem?

Network infrastructure is only needed for distributed deployments

Network infrastructure is not important for Splunk deployments

Network infrastructure only affects the search head

Network infrastructure affects data ingestion and communication between Splunk components

Which of the following is an example of a functional requirement for a Splunk deployment?

The system must support 500 concurrent users

The system must provide role-based access control

The system must have a recovery time objective of 2 hours

The system must encrypt data in transit

SplunkEnterprise Certified Architect

Domain 1Objective 1

Gather Requirements SPLK-2002 Practice Questions (Page 3)

Part of the Requirements and Infrastructure Planning domain, which makes up ~12% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–7 in this domain), expect 1–1 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

6concepts

Questions 11–15

11expert · hard
A Splunk architect is gathering requirements for a deployment. The stakeholders have conflicting requirements: they want real-time search on all data, but they also want to minimize hardware costs. Which of the following is the best approach to reconcile these requirements?
Select an answer first
12foundation · easy
When profiling user roles for a Splunk deployment, which of the following is a key factor to identify?
Select an answer first
13foundation · easy
Which of the following is an example of a non-functional requirement for a Splunk deployment?
Select an answer first
14expert · hard
A Splunk architect is using a requirements gathering checklist. They have documented the number of users, daily ingest volume, and retention period. However, they have not documented the existing network infrastructure. Why is this a problem?
Select an answer first
15foundation · easy
Which of the following is an example of a functional requirement for a Splunk deployment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.