An administrator is configuring a KV Store collection in a search head cluster. The collection will store sensitive data that must be encrypted at rest. Which configuration is required?

Enable encryption in the collection definition.

Use a separate KV Store instance for sensitive data.

Enable encryption at the Splunk instance level.

Encryption is not supported for KV Store.

A search head cluster has three members. An administrator needs to ensure that KV Store data is replicated to all members to provide high availability. What is the default replication factor for KV Store in a search head cluster?

It depends on the number of members.

What must be configured to enable KV Store replication in a search head cluster?

A replication factor greater than 1 and a search head cluster with at least three members

An indexer cluster configured with the same replication factor

A standalone KV Store instance separate from the search head cluster

A dedicated KV Store captain and replication factor of 1

What is a common symptom of KV Store replication issues in a search head cluster?

All KV Store collections become read-only

Search results are inconsistent across cluster members

Indexer performance degrades significantly

The search head cluster captain is automatically demoted

A Splunk architect is deploying a search head cluster (SHC) with three members. They plan to create a KV Store collection that will be used by a custom app to store user session data. The architect wants to ensure that the collection is automatically available on all search head cluster members and that writes are replicated consistently. Which configuration step is required to achieve this?

Create the collection on the KV Store captain only; the captain replicates it to all members.

Create the collection in the search head captain's local directory and then manually copy it to each member.

Define the collection in the app's default/kvstore.conf on each search head cluster member and deploy the app to the cluster.

Use the REST API to create the collection on one member, and it will automatically sync to the other members.

SplunkEnterprise Certified Architect

Domain 4Objective 6

KV Store Collection in Splunk Clusters SPLK-2002 Practice Questions (Page 2)

Part of the Search Head Clustering and KV Store domain, which makes up ~19% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

4concepts

Questions 6–10

6application · medium
An administrator is configuring a KV Store collection in a search head cluster. The collection will store sensitive data that must be encrypted at rest. Which configuration is required?
Select an answer first
7application · easy
A search head cluster has three members. An administrator needs to ensure that KV Store data is replicated to all members to provide high availability. What is the default replication factor for KV Store in a search head cluster?
Select an answer first
8foundation · easy
What must be configured to enable KV Store replication in a search head cluster?
Select an answer first
9foundation · easy
What is a common symptom of KV Store replication issues in a search head cluster?
Select an answer first
10application · medium
A Splunk architect is deploying a search head cluster (SHC) with three members. They plan to create a KV Store collection that will be used by a custom app to store user session data. The architect wants to ensure that the collection is automatically available on all search head cluster members and that writes are replicated consistently. Which configuration step is required to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.