An administrator is preparing a new master app bundle for an indexer cluster. The bundle must include a custom search command and a set of lookup files. What is the correct way to structure the master-apps directory?

Place the apps in the cluster master's default apps directory and they will be automatically bundled.

Create a directory for each app, with the app's configuration files and lookups inside, and place them in the master-apps directory.

Create a single compressed archive containing all apps and place it in the master-apps directory.

Place all configuration files directly in the master-apps directory without subdirectories.

What is the primary purpose of master app bundles in an indexer cluster?

To store search results temporarily on the cluster master for faster retrieval

To distribute configuration and app files from the cluster master to all cluster peers

To provide a backup of the cluster master's own configuration for disaster recovery

To replicate indexed data across peers to ensure data redundancy

An administrator is troubleshooting why a peer is not using the latest version of an app from the master bundle. The peer's bundle version is older than the master's. What is the most likely cause?

The peer is configured to reject bundles.

The master did not create a new bundle.

The peer has a local app that overrides the bundle app.

The peer was offline when the bundle was pushed and has not reconnected.

A new peer is added to an existing indexer cluster. The cluster has an active master app bundle. What happens when the new peer joins?

The new peer receives the bundle only after a restart.

The new peer does not receive the bundle until the next bundle is created.

The new peer must be manually configured with the bundle.

The master sends the current bundle to the new peer automatically.

An administrator is managing an indexer cluster and needs to update a custom search command. The update is critical and must be applied immediately. However, the cluster is experiencing high indexing load. What is the best approach?

Apply the bundle only to a subset of peers to reduce impact.

Wait for a maintenance window to apply the bundle, even if it delays the update.

Use rolling restarts by manually updating each peer.

Apply the bundle immediately, accepting that peers will restart and temporarily stop indexing.

SplunkEnterprise Certified Architect

Domain 3Objective 7

Master App Bundles SPLK-2002 Practice Questions (Page 1)

Part of the Indexer Clustering domain, which makes up ~25% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~9–15 in this domain), expect 1–2 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

5concepts

Questions 1–5

1application · medium
An administrator is preparing a new master app bundle for an indexer cluster. The bundle must include a custom search command and a set of lookup files. What is the correct way to structure the master-apps directory?
Select an answer first
2foundation · easy
What is the primary purpose of master app bundles in an indexer cluster?
Select an answer first
3expert · hard
An administrator is troubleshooting why a peer is not using the latest version of an app from the master bundle. The peer's bundle version is older than the master's. What is the most likely cause?
Select an answer first
4application · medium
A new peer is added to an existing indexer cluster. The cluster has an active master app bundle. What happens when the new peer joins?
Select an answer first
5expert · hard
An administrator is managing an indexer cluster and needs to update a custom search command. The update is critical and must be applied immediately. However, the cluster is experiencing high indexing load. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.