Splunk Certified Cybersecurity Defense Architect SPLK-5003 Exam Questions
What is the role of the Cluster Manager (Master Node) in indexer clustering?
Correct Answer: B
The Cluster Manager controls replication, bucket placement, and ensures cluster health in indexer clustering.
Which Splunk component is responsible for distributing configuration updates to forwarders?
Correct Answer: B
The Deployment Server manages and distributes apps and configuration files to forwarders, ensuring centralized configuration management.
Which configuration file is used to define index settings in Splunk?
Correct Answer: B
indexes.conf is used to define index storage, retention policies, bucket settings, and volume configurations.
A Splunk index bucket transitions from hot to warm when:
Correct Answer: A
Hot buckets roll to warm based on size, time, or event count thresholds defined in indexes.conf. This ensures efficient indexing and storage management.
What is the primary purpose of a Heavy Forwarder?
Correct Answer: B
Heavy Forwarders can parse, filter, and transform data before forwarding it to indexers, unlike Universal Forwarders.