License Master Configuration in a Clustered Environment SPLK-2002 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A Splunk indexer cluster has exceeded its license quota. The License Master is configured with the default violation policy. The administrator needs to ensure that critical security data from a specific forwarder is still indexed, while non-critical data is blocked. What is the most effective way to achieve this?

   • AConfigure the security forwarder to send data directly to the License Master, bypassing the cluster peers.
   • BConfigure the License Master to allow indexing for the security forwarder by adding it to a separate license pool with a higher priority.
   • CStop the non-critical forwarders manually and allow only the security forwarder to send data.
   • DSet the violation policy to 'warn' on the License Master so all data is indexed, including the security data.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A Splunk architect is designing a disaster recovery plan for a cluster. The primary License Master is in a primary data center, and the architect wants to ensure that if the entire primary data center fails, the cluster in the secondary data center can continue to index data. The secondary data center has its own Splunk Enterprise license. What is the most appropriate approach?

   • AUse a single License Master in the primary data center and configure the secondary cluster to use the 'warn' policy during a failover.
   • BConfigure the secondary License Master with the same license and use DNS failover to redirect the secondary cluster's peers to it.
   • CInstall a License Master in the secondary data center and configure the primary cluster's peers to fail over to it.
   • DHave the secondary cluster's peers point to the primary License Master over a WAN link and rely on the primary's license.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Splunk administrator is troubleshooting why a specific indexer peer is not appearing in the License Master's 'Licensing' page. The peer is configured as a license slave and can reach the License Master. What is the most likely reason for this issue?

   • AThe License Master's `license_usage.log` is full and not accepting new entries.
   • BThe peer's `server.conf` has the `[license]` stanza set to `master` instead of `slave`.
   • CThe peer has not yet reported its license usage; the License Master only shows peers that have sent a usage report.
   • DThe peer is configured with a different license pool than the License Master.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which statement accurately describes how the License Master manages licensing for cluster peers and search heads?

   • AIt requires every node to have its own valid license file installed locally.
   • BIt collects usage reports from all nodes and enforces the total pooled license volume.
   • CIt only monitors search head usage and ignores indexer and forwarder consumption.
   • DIt grants each node a fixed, independent license quota that cannot be shared.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In a clustered Splunk Enterprise deployment, what is the primary function of the License Master?

   • AIt replicates configuration bundles to all search heads to maintain consistent app deployment.
   • BIt provides a single authentication endpoint for all cluster users and API tokens.
   • CIt stores and indexes all data for the cluster to ensure consistent search results.
   • DIt aggregates license usage from all cluster members and enforces the licensed daily volume.
   Reveal Solution Discussion Select an answer first