SPLK-2002 practice examsIn development
Splunk Enterprise Certified Architect
Designing a Splunk deployment rather than administering one: sizing from ingest, retention, concurrency and availability, index and storage design with volumes and SmartStore, indexer clustering where valid and complete mean different things, and search head clustering with a deployer that is not the deployment server; then forwarder architecture and filtering before the indexers, dense against sparse search behaviour, reading queue fill to locate a constraint, and upgrade order, backup scope and continuity design.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Sizing, index design and clustering | Not published |
| Forwarder architecture, performance, diagnosis and operations | Not published |
Two sample questions
1. What does the monitoring console give an architect that internal searches do not?
- A curated view across every instance at once — correct
- A copy of the raw events for each source
- A backup of the configuration bundle
- A list of the licences installed
Why: It collects the same internal data into comparable dashboards.
2. What bounds a dense search?
- Dashboard count
- Bucket elimination
- Disk read throughput — correct
- Lookup size in this setup
Why: Dense searches are bound by disk reads.
The real SPLK-2002 exam
| Length | 90 minutes |
|---|---|
| Questions | 85 |
| Pass mark | 70% |
| Price | Purchased per attempt through Pearson VUE |
| Recommended before you sit it | Splunk expects the Enterprise Certified Admin credential and the architect course sequence beforehand. |
| Valid for | 3 years |
Exam facts as published by Splunk; always check the vendor’s page before you book.
Study SPLK-2002 with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.