Identify Best Practices for Forwarder Tier Design SPLK-2002 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a common method for troubleshooting a forwarder that is not sending data to the indexer?

   • ARestarting the indexer to reset the connection
   • BDeleting the forwarder's `inputs.conf` file to reset its configuration
   • CChecking the forwarder's `splunkd` logs for connection errors or authentication failures
   • DIncreasing the forwarder's output queue size to allow more data to buffer
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key consideration when designing a forwarder tier for a large deployment with multiple network segments?

   • ADisabling encryption between forwarders and indexers to reduce latency
   • BPlacing a heavy forwarder in each network segment to aggregate and filter data before sending it to the central indexer cluster
   • CConfiguring all forwarders to send data directly to a single indexer to avoid complexity
   • DUsing a single universal forwarder to collect data from all segments to simplify management
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How does a forwarder distribute data across multiple indexers when using load balancing?

   • AIt uses a round-robin method, sending data to each indexer in sequence
   • BIt sends all data to the indexer with the most available disk space
   • CIt sends all data to a primary indexer and only uses others if the primary fails
   • DIt randomly selects an indexer for each event, ensuring even distribution
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When planning forwarder capacity, what is the primary constraint that determines how much data a single forwarder can handle?

   • AThe CPU speed of the forwarder machine
   • BThe available disk space on the forwarder
   • CThe network bandwidth between the forwarder and the indexers
   • DThe number of inputs configured on the forwarder
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A financial institution is deploying Splunk Enterprise and must secure all data in transit between forwarders and indexers. They also need to ensure that only authorized forwarders can send data to the indexers. The security team requires mutual authentication using certificates. Which configuration should be implemented?

   • AUse Splunk's built-in SSL with a shared secret key between forwarders and indexers.
   • BEnable SSL on the forwarders and indexers using a self-signed certificate on each forwarder.
   • CConfigure the indexers to accept only data from forwarders that present a certificate signed by a common internal CA.
   • DDisable SSL and rely on the network firewall to protect the communication.
   Reveal Solution Discussion Select an answer first