Splunk
SPLK-3 00 3 Ex am
Splunk Core Certified Consultant Exam
Demo
Questions & Answers
https://www.dumpsfactory.com/splunk/splk-3003-
Questions&AnswersPDF
Page2
ProductQuestions:85
Version:4.0
Question:1
HowdoesMonitoringConsole(MC)initiallyidentifytheserverrole(s)ofanewSplunkInstance?
A.TheMCusesaRESTendpointtoquerytheserver.
B.RolesaremanuallyassignedwithintheMC.
C.Rolesarereadfromdistsearch.conf.
D.TheMCassignsallpossiblerolesbydefault.
Answer:C
Question:2
Acustomerhasaskedforafive-nodesearchheadcluster(SHC),
butdoesnothavethestorage
budgettouseareplicationfactorgreaterthan2.Theywouldliketounderstandwhatmighthappen
intermsoftheusers’abilitytoviewhistoricscheduledsearchresultsiftheylogontoasearchhead
whichdoesn’tcontainoneofthe2copiesofagivensearchartifact.
Whichofthefollowingstatementsbestdescribeswhatwouldhappeninthisscenario?
A.Thesearchheadthattheuserhasloggedontowillproxytherequiredartifactovertoitselffroma
searchheadthat currentlyholdsacopy.
Acopywill alsobereplicatedfromthat
searchhead
permanently,soitisavailableforfutureuse.
B.Becausethedispatchfoldercontainingthesearchresultsisnotpresentonthesearchhead,
the
userwillnotbeabletoviewthesearchresults.
C.Theuserwillnotbeabletoseetheresultsofthesearchuntiloneofthesearchheadsisrestarted,
forcingsynchronizationofalldispatchedartifactsacrossallsearchheads.
D.TheuserwillnotbeabletoseetheresultsofthesearchuntiltheSplunkadministratorissuesthe
applyshcluster-bundlecommandonthesearchheaddeployer,
forcingsynchronizationof
all
dispatchedartifactsacrossallsearchheads.
Answer:A
Question:3
MonitoringConsole(MC)healthcheckconfigurationitemsarestoredinwhichconfigurationfile?
A.healthcheck.conf
B.alert_actions.conf
Questions&AnswersPDF
Page3
C.distsearch.conf
D.checklist.conf
Answer:D
Reference:https://docs.splunk.com/Documentation/Splunk/8.1.0/DMC/Customizehealthcheck
Question:4
WhatshouldbeconsideredwhenrunningthefollowingCLIcommandswithagoalofacceleratingan
indexclustermigrationtonewhardware?
A.Dataingestionrate
B.NetworklatencyandstorageIOPS
C.Distanceandlocation
D.SSLdataencryption
Answer:B
Question:5
Whichstatementistrueaboutsubsearches?
A.Subsearchesarefasterthanothertypesofsearches.
B.Subsearchesworkbestforjoiningtwolargeresultsets.
C.Subsearchesrunatthesametimeastheiroutersearch.
D.Subsearchesworkbestforsmallresultsets.
Answer:A
Reference: https://community.splunk.com/t5/Archive/Looking-for-way-to-explain-why-subsearchesare-so-slow/m-p/479133
Question:6
AcustomerhasbeenusingSplunkforoneyear,
utilizingasingle/all-in-oneinstance.
Thissingle
Splunkserverisnowstrugglingtocopewiththedailyingestrate.
Also,Splunkhasbecomeavital
Questions&AnswersPDF
Page4
systeminday-to-dayoperationsmakinghighavailabilityaconsiderationfortheSplunkservice.The
customerisunsurehowtodesignthenewenvironmenttopologyinordertoprovidethis.
Whichresourcewouldhelpthecustomergathertherequirementsfortheirnewarchitecture?
A.Directthecustomertothedocs.splunk.comandtell
themthatall theinformationtohelpthem
selecttherightdesignisdocumentedthere.
B. Askthecustomertoengagewiththesalesteamimmediatelyastheyprobablyneedalarger
license.
C. Referthecustomertoanswers.splunk.comassomeoneelsehasprobablyalreadydesigneda
systemthatmeetstheirrequirements.
D. Refer thecustomer totheSplunkValidatedArchitecturesdocument
inorder toguidethem
throughwhichapprovedarchitecturescouldmeettheirrequirements.
Answer:D
Reference:https://www.splunk.com/pdfs/technical-briefs/splunk-validated-architectures.pdf
Question:7
Thecustomerhasanindexerclustersupportingawidevarietyofsearchneeds,includingscheduled
search,datamodelacceleration,andsummaryindexing.Hereisanexcerptfromtheclustermater’s
server.conf:
Whichstrategyrepresentstheminimumandleast
disruptivechangenecessarytoprotect
searchabilityoftheindexerclusterincaseofindexerfailure?
the
A.EnablemaintenancemodeontheCMtopreventexcessivefix-upandbringthefailedindexerback
online.
B.Leavereplication_factor=2,increasesearch_factor=2andenablesummary_replication.
C. Convert thecluster tomulti-siteandmodifytheserver.conf
tobesite_replication_factor=2,
site_search_factor=2.
D.Increasereplication_factor=3,search_factor=2toprotectthedata,andallowtheretoalwaysbea
searchablecopy.
Answer:D
Question:8
Whatistheprimarydriverbehindimplementingindexerclusteringinacustomer’senvironment?
A.Toimproveresiliencyasthesearchloadincreases.
B.Toreduceindexinglatency.
C.ToscaleoutaSplunkenvironmenttoofferhigherperformancecapability.
D.Toprovidehigheravailabilityforbucketsofdata.
Questions&AnswersPDF
Page5
Answer:D
Reference:
https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Howclusteredsearchworks