A search head cluster admin is planning to upgrade an app that is critical for search functionality. The upgrade involves changes to search-time props.conf. What is the best practice to minimize risk?

Backup the deployer's repository before pushing the upgrade.

Deploy the upgrade directly to the production cluster and monitor for issues.

Upgrade the app on one member first and then replicate to others.

Test the app on a non-production search head cluster before deploying.

An admin has pushed a configuration bundle to a search head cluster. They want to confirm that all members have the same configuration. What is the most reliable way to do this?

Run `splunk show shcluster-status` on the deployer and check for 'latest bundle' status.

Compare the checksums of configuration files on each member.

Ask each member's admin to confirm manually.

Check the `_internal` index on each member for configuration changes.

A search head cluster admin notices that a configuration change made directly on one cluster member is not being overwritten by the deployer's next push. What is the most likely reason for this behavior?

The member's local configuration takes precedence over the deployed bundle.

The deployer only pushes apps, not configuration files.

The deployer is not configured to overwrite existing files.

The member is not part of the cluster.

A search head cluster admin is troubleshooting an issue where a configuration change is not taking effect on some members. The change was made in the deployer's repository and pushed. What is the most likely cause?

The members are not connected to the network.

The app was not placed in the correct directory in the repository.

The members have local configuration that overrides the deployed bundle.

Which setting in server.conf is required to enable the deployer on a search head cluster deployer node?

deployer_uri = https://deployer.example.com:8089

SplunkEnterprise Certified Architect

Domain 4Objective 3

Search Head Cluster Deployer SPLK-2002 Practice Questions (Page 1)

Part of the Search Head Clustering and KV Store domain, which makes up ~19% of our current practice bank. Splunk does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

4concepts

Questions 1–5

1expert · hard
A search head cluster admin is planning to upgrade an app that is critical for search functionality. The upgrade involves changes to search-time props.conf. What is the best practice to minimize risk?
Select an answer first
2application · medium
An admin has pushed a configuration bundle to a search head cluster. They want to confirm that all members have the same configuration. What is the most reliable way to do this?
Select an answer first
3application · medium
A search head cluster admin notices that a configuration change made directly on one cluster member is not being overwritten by the deployer's next push. What is the most likely reason for this behavior?
Select an answer first
4application · medium
A search head cluster admin is troubleshooting an issue where a configuration change is not taking effect on some members. The change was made in the deployer's repository and pushed. What is the most likely cause?
Select an answer first
5foundation · easy
Which setting in server.conf is required to enable the deployer on a search head cluster deployer node?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SPLK-2002

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “SPLK-2002” is a trademark of its owner, used for identification only.