Splunk SPLK-2002 Exam - Topic 9 Question 75 Discussion

Actual exam question for Splunk's SPLK-2002 exam

Question #: 75
Topic #: 9

[All SPLK-2002 Questions]

A Splunk deployment is being architected and the customer will be using Splunk Enterprise Security (ES) and Splunk IT Service Intelligence (ITSI). Through data onboarding and sizing, it is determined that over 200 discrete KPIs will be tracked by ITSI and 1TB of data per day by ES. What topology ensures a scalable and performant deployment?

ATwo search heads, one for ITSI and one for ES.

BTwo search head clusters, one for ITSI and one for ES.

COne search head cluster with both ITSI and ES installed.

DOne search head with both ITSI and ES installed.

Show Suggested Answer

Suggested Answer: A, C

by Eladia at Oct 02, 2023, 09:18 PM

Limited Time Offer

25%

Off

Get Premium SPLK-2002 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Corinne

6 months ago

C could work, but I’d still prefer B for future growth.

upvoted 0 times

...

An

6 months ago

Definitely not A, that would bottleneck performance.

upvoted 0 times

...

Tina

7 months ago

Wait, can one cluster really manage both ITSI and ES effectively?

upvoted 0 times

...

Luz

7 months ago

I agree, two search head clusters can handle the load better!

upvoted 0 times

...

Denae

7 months ago

Option B seems like the best choice for scalability.

upvoted 0 times

...

Nana

7 months ago

I’m a bit confused about the differences between clusters and single search heads. I thought option A could work, but now I’m leaning towards option C after reviewing the requirements.

upvoted 0 times

...

Allene

7 months ago

I practiced a similar question, and I think having separate clusters for ITSI and ES could help with managing the KPIs better. So, option B seems reasonable.

upvoted 0 times

...

Francine

7 months ago

I'm not entirely sure, but I feel like having a single search head cluster for both ITSI and ES could lead to performance issues. Maybe option C isn't ideal?

upvoted 0 times

...

Juliann

8 months ago

I remember we discussed the importance of scalability, especially with such a high volume of data. I think option B might be the best choice.

upvoted 0 times

...

Whitney

8 months ago

I'm leaning towards option B - two search head clusters, one for ITSI and one for ES. That way, each component can be scaled and optimized independently to handle the respective workloads. Trying to cram both ITSI and ES onto a single search head cluster might not be the best approach given the scale.

upvoted 0 times

...

Sol

8 months ago

Okay, let's see. With over 200 KPIs for ITSI and 1TB of data per day for ES, that's a significant amount of data and workload. I'm thinking a single search head might not be able to handle that, so a search head cluster is probably the way to go.

upvoted 0 times

...

Lauran

8 months ago

Hmm, I'm a bit unsure about this one. The question is asking about the overall topology, but it's also mentioning specific details like the number of KPIs and data volume. I'll need to think through how those factors impact the architecture.

upvoted 0 times

...

Carissa

8 months ago

This looks like a pretty straightforward Splunk architecture question. I think the key is to consider the scale and performance requirements mentioned in the prompt.

upvoted 0 times

...

Carman

8 months ago

Okay, I've got this. The question is asking for a solution to run containerized apps without installing them on the session hosts. That means we need a way to package and deploy the apps in a containerized format. MSIX app packages seem like the logical choice here.

upvoted 0 times

...

Titus

8 months ago

I remember studying about encryption for protecting sensitive data, it seems like the most secure method we discussed.

upvoted 0 times

...

Malcom

8 months ago

This seems like a straightforward question about data privacy and security. I'll carefully read through the options and think about which one best fits the description of improper PII disclosure.

upvoted 0 times

...

Ciara

1 year ago

Clearly option C is the way to go. I mean, who needs performance or scalability when you can just cram everything onto one search head cluster? It'll be fine, right? *nervous laughter*

upvoted 0 times

Hyman

12 months ago

Yeah, option C seems risky. It's better to separate the workloads to ensure a more stable and efficient deployment.

upvoted 0 times

...

Kenia

12 months ago

I agree, having dedicated search head clusters for each application will prevent any performance issues that may arise from overloading a single search head.

upvoted 0 times

...

Derrick

12 months ago

I think option B is the best choice. Having separate search head clusters for ITSI and ES will ensure better performance and scalability.

upvoted 0 times

...

Kate

1 year ago

I'm with Alfred on this one. Two search head clusters is the way to go. It's the only option that ensures you can scale and handle the data load without everything grinding to a halt.

upvoted 0 times

Nadine

11 months ago

Yeah, I think splitting up the search head clusters is the way to go to ensure everything runs smoothly with that amount of data.

upvoted 0 times

...

Daryl

11 months ago

I think having separate search head clusters for ITSI and ES makes the most sense in terms of scalability and performance.

upvoted 0 times

...

Danilo

1 year ago

I agree with you, having two search head clusters is definitely the best option for this scenario.

upvoted 0 times

...

Peggy

1 year ago

Oh man, option D is just begging for trouble. One search head handling both ITSI and ES? That's like trying to fit an elephant and a giraffe in a Smart car. Not happening!

upvoted 0 times

...

Alfred

1 year ago

Two search head clusters, one for each, is definitely the way to go. You don't want to risk overloading a single search head with that kind of data volume. Separating them is the smart move.

upvoted 0 times

Christiane

12 months ago

Two search head clusters, one for each, is definitely the way to go.

upvoted 0 times

...

Margret

1 year ago

B) Two search head clusters, one for ITSI and one for ES.

upvoted 0 times

...

Vilma

1 year ago

A) Two search heads, one for ITSI and one for ES.

upvoted 0 times

...

Frederica

1 year ago

Choosing a single search head with both ITSI and ES installed seems like a recipe for disaster with that much data. I'd go with option B to keep them separated for better scalability and performance.

upvoted 0 times