Splunk SPLK-2002 Exam Prep
Splunk Enterprise Certified Architect (Page 17 )

• Correct exam answer: A — HKEY_LOCAL_MACHINE
• The relevant location is associated with HKEY_LOCAL_MACHINE\SAM.
• The SAM does not store passwords in plain text; it stores password hashes.

• HKEY_CURRENT_USER contains settings for the currently logged-in user, not the account-password database.
• HKEY_USERS contains user profiles and settings loaded for users.
• HKEY_CURRENT_CONFIGURATION contains hardware/profile configuration information.

• Crash cart: Provides local physical access, not remote access.
• Jump box: A secured intermediary used to reach devices over the normal network; it may be inaccessible if the appliance has not booted.
• Secure Shell (SSH): Requires the device’s operating system and network services to be running properly.

• Restrict a port to a defined number of MAC addresses
• Use statically assigned or “sticky” MAC addresses
• Shut down or restrict the port when violations occur

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect suspicious network activity, but is not the primary control for limiting switch MAC entries.
• NGFW: Filters traffic at the network boundary; it does not directly prevent MAC table flooding on access switches.

• On VirtualNetworkA: enable Allow gateway transit.
• On VirtualNetworkB: enable Use remote gateways.

• state preserves the client’s original context, such as the specific idea URL the user requested.
• The portal sends that value in the OAuth authorization request.
• Salesforce returns it after authorization, allowing the portal to redirect the user to the original idea rather than the Ideas home page.

• Assign endpoints to a group based on the result of one policy.
• Use that group as the scope of another policy.
• This effectively passes the endpoints from one policy’s processing flow to another.

• Customer needs: Primary focus in agile; guides prioritization and decision-making.
• Organization’s needs: Important constraints, but processes should be tailored when they create waste.
• Agile lead/project manager: Their role is to facilitate value delivery, not prioritize their own preferences.

• Distinct values = 69

• Unique values = 4

• Installing software
• Applying configuration changes
• Calling PowerShell scripts
• Running setup or customization commands

cmd 
powershell.exe -ExecutionPolicy Bypass -File C:\Scripts\ConfigureVM.ps1

• GPO logon script: Runs only when a user logs on and depends on domain/GPO processing.
• GPO startup script: Runs during startup, but requires the VM to be domain joined and receives the applicable GPO.
• Place scripts in a VHD: Merely makes the scripts available; it does not automatically execute them.

• A — Securing information assets: This is the responsibility of management and operational/security teams.
• B — Validating protection: Correct. The auditor checks whether controls—such as access restrictions, encryption, retention, and handling procedures—match the asset’s classification.
• C — Ensuring alignment with regulations: Management and legal/compliance functions typically establish classification requirements; the auditor may assess compliance but does not primarily define alignment.
• D — Defining classification levels: This is a management responsibility based on business needs, risk, and regulatory obligations.

• Act as the default gateway for devices in that VLAN
• Route traffic between different VLANs
• Provide management access to the switch

text 
interface vlan 10 
 ip address 192.168.10.1 255.255.255.0

• Prevention costs – costs incurred to stop defects occurring, such as staff training, quality planning and supplier evaluation.
• Appraisal costs – costs of checking whether products meet standards, such as inspection, testing and quality audits.
• Internal failure costs – costs of defects found before delivery to customers, such as scrap, rework and retesting.
• External failure costs – costs of defects found after delivery, such as warranty claims, returns, complaints and product recalls.

• B — Notify affected business units: Notification should follow an initial determination of scope and impact; otherwise, the organization may communicate incomplete or inaccurate requirements.
• C — Assess noncompliance risk: Risk assessment requires understanding the regulation’s requirements first.
• D — Inform senior management: Management should be informed, but with a clear summary of the regulation’s impact, risks, and recommended actions.

• contoso.onmicrosoft.com
• contoso1.onmicrosoft.com

• onmicrosoft.com domains: Maximum of five per tenant.
• Custom domains: Domains that your organization owns and verifies in Microsoft 365.

• A. IDS attack signatures: Detects suspicious network activity, but is not primarily designed to scan uploaded files for malware.
• C. Load balancer: Distributes traffic among servers and improves availability; it does not inspect files for threats.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection, but its primary role is not malware scanning of uploaded documents.

• miami.weyland.com requires a custom domain, which is not available in the Free tier.
• Two instances require a tier that supports scaling out. Standard supports multiple instances.
• SSL support is available in Standard.
• 12 GB of storage exceeds the storage limit of the Basic tier in the older Azure pricing model used by this question.
• Standard provides sufficient storage and features while being cheaper than higher tiers—though higher tiers are not listed here.

• Free/Shared: insufficient features for custom domains, SSL, and multiple instances.
• Basic: supports some production features, but its storage capacity is insufficient for the required 12 GB.

• Fine-tuning requires a properly formatted training dataset.
• For classification or instruction-style fine-tuning, examples are supplied in JSONL format.
• Each line represents one training example, typically containing the input prompt and the desired completion or label.
• The file must then be uploaded or made available to the Microsoft Foundry fine-tuning workflow.

• A: Prompt Flow is useful for prompt experimentation, but it is not required to start fine-tuning.
• B: You do not need to deploy the base model to an online endpoint before fine-tuning.
• C: Tracing supports observability and evaluation, but it does not prepare the fine-tuning job or dataset.

• Domain controllers, because the requirement specifically excludes them. However, note that both member servers and domain controllers run Windows Server, so OS targeting alone cannot distinguish them unless the targeting option allows selecting the relevant server role/version. In the usual exam interpretation, target the applicable server OS category.
• Client computers, because they run a client Windows operating system.

• Domain: Targets membership in a domain, not the computer’s operating-system type.
• Security Group: Would require creating and maintaining a group containing all member servers, increasing administrative effort.
• Environment Variable: Not designed to reliably identify member servers.

• Accept terms of use
• Enter a temporary code or credentials
• Provide basic registration information

• Enterprise authentication — Authenticates organizational users, often with centralized identity services; it is not specifically designed for temporary guest access.
• Ad hoc network — A temporary device-to-device network, not an authentication process.
• WPA3 — A wireless security standard. It protects Wi-Fi access but does not provide the web-based temporary access workflow described here.

1. Clear principles and boundaries — Employees have freedom, but decisions must remain within clear organizational values, policies and limits.
2. High degree of freedom — Managers are trusted to make decisions rather than seeking continual approval from senior management.
3. Frontline customer responsibility — Customer-facing managers should be empowered to manage customer relationships and respond quickly to needs.
4. Transparent and ethical information — Information should be openly available and used honestly, supporting trust and informed decision-making.

• New investment: $536,500
• Resulting NPV: $0

• Note the question number before leaving—for example, Question 38.
• Use the exam’s question navigator or Back/Previous button to return to that number.
• If you close or refresh the page, your position may not be saved, depending on the site. Reopen the page and select the question number again.
• Avoid using the browser’s Back button if it causes the exam page to reload; use the exam’s built-in navigation instead.

text 
user<TAB>action<TAB>status

text 
user|action|status

• Colons: Although colons commonly appear in log data, they are not a supported delimiter choice in the FX workflow described by this exam question.
• Spaces: Spaces are not treated as a supported delimiter for this extraction method; ordinary text often contains variable spacing.

• A local network gateway represents an on-premises network—its address space and VPN device information—for an Azure Site-to-Site VPN connection.
• It does not control which connection types are allowed between Azure web servers and database servers.
• It is also unnecessary when both server groups are in the same Azure virtual network.

• Disable high concurrency: Changes workspace-wide behavior and is not the targeted way to isolate these workloads.
• Modify the number of executors: Adjusts capacity and performance, but does not provide workload isolation.
• Set the default environment: Controls libraries and runtime configuration, not compute isolation.

1. Yes — One account can manage multiple subscriptions

1. No — You cannot merge two subscriptions into one

1. Yes — A resource belongs to only one subscription

• A — Capacity: The system must handle all current records and anticipated future records. A system that cannot cope with volume will quickly become ineffective.
• C — Accuracy: Academic records are critical, so the new system must be at least as accurate as the existing system and comparable systems. Poor accuracy could cause serious administrative and reputational problems.
• D — Integration: Linking with the university’s financial systems supports consistency and avoids duplicate data entry, especially for registration, deregistration and fee-related transactions.

• B — Parallel running: This is a useful implementation and risk-control technique, but it is not an essential feature of the system itself. It may also be expensive and time-consuming.
• E — Internet access for all information: This creates significant confidentiality and security risks. External access might be needed for selected services, but unrestricted access to all information is not essential and would be inappropriate for student records.

• Matching hashes: The software likely has not changed.
• Different hashes: The software was modified or corrupted.

• Encryption: Protects confidentiality by making data unreadable; it does not primarily detect changes.
• Baselines: Define an approved system or configuration state, but they are not the specific integrity mechanism here.
• Tokenization: Replaces sensitive data with substitute values.

• Instant messaging/chat: Can be abused to send malicious links or attachments, but is not the answer most directly associated with high-risk file sharing.
• E-mail: A common malware delivery method, but the question emphasizes an application type known for direct file exchange.
• End-to-end applications: This describes communication protection or architecture, not a specific malware distribution risk.

xml 
<apex:page> 
    <apex:stylesheet value="{!URLFOR($Resource.MyStyles, 'styles/main.css')}" /> 
</apex:page>

• <apex:includeScript> is for JavaScript.
• <apex:includeStyle> is not a valid Visualforce component.
• <apex:require> is not the Visualforce tag used to load CSS.

• Proxy server: Acts as an intermediary for requests, but does not necessarily provide an encrypted connection to the corporate network.
• NGFW: A firewall with advanced inspection and filtering capabilities; it may support VPNs but is not the remote-access solution itself.
• Security zone: A logical network grouping based on trust or security requirements, not a method for remote access.

sql 
ALTER TABLE dbo.DimCustomer 
ADD CONSTRAINT PK_DimCustomer 
PRIMARY KEY NONCLUSTERED (CustomerKey) 
NOT ENFORCED;

1. ALTER TABLE dbo.DimCustomer
2. ADD CONSTRAINT PK_DimCustomer PRIMARY KEY NONCLUSTERED (CustomerKey)
3. NOT ENFORCED

• Error correction (ECC): Improves data reliability but does not maximize bandwidth.
• RAM voltage: Increasing voltage may affect stability or speed, but it is not the primary method for increasing module bandwidth.
• Physical module size: Refers to the capacity or form factor of the RAM, not its data-transfer bandwidth.

Correct reasoning

• Create storage5 as a General-purpose v2 (StorageV2) account.
• Configure Blob object replication from storage5 to an existing compatible storage account.
• The destination must support object replication—typically another StorageV2 or premium block blob account.
• Blob versioning must be enabled on both accounts.
• Blob change feed must be enabled on the source account.
• The accounts must meet Azure’s object-replication requirements, including being in supported regions and having compatible configuration.

• Deterrent control: The signs warning people they may be filmed discourage unauthorized or malicious behavior. They may prevent incidents by influencing behavior, but their primary purpose is to deter.
• Detective control: The CCTV system monitors and records activity so security personnel can identify suspicious or unauthorized actions.

• Preventive: Blocks or prevents an incident, such as a lock or access-control system.
• Corrective: Fixes or restores systems after an incident.
• Directive: Tells people what they must do, typically through policies or procedures.
• Compensating: Provides an alternative control when the preferred control cannot be used.

• Storage usage of files stored in Microsoft Teams: SharePoint site usage report

• Number of active users per team: Microsoft Teams usage report

1. SharePoint site usage report
2. Microsoft Teams usage report

• LastName: Required.
• FirstName: Optional.
• AccountId: Optional; a Contact may be associated with an Account later or remain private, depending on organization settings.
• Name: A compound display field made from first and last name; it isn’t entered as a separate field.

• Prevention costs: Avoiding defects, such as staff training and improved product design. The company has invested in these.
• Appraisal costs: Detecting defects before products reach customers, such as inspection and testing. The planned batch sampling has not been implemented.
• Internal failure costs: Correcting defects found before delivery.
• External failure costs: Dealing with defects after delivery, such as refunds, replacements, complaints and lost sales.

• Row counts
• Minimum and maximum values for columns
• Distinct-value information
• Other characteristics used for optimization

• Data only needs to be current at 7 AM each day, so scheduled refresh is sufficient.
• Import mode provides the fastest report interaction because data is stored in Power BI’s in-memory engine.
• It supports row-level security (RLS), including the USERNAME() filter.
• You can limit the imported data to the current year and previous three years to reduce model size.
• DirectQuery would generally provide slower visual response times and is unnecessary here.
• Dual is mainly useful in composite models where some tables use DirectQuery and others use Import. That is not required by this scenario.
• Live connection is not appropriate because you are creating the semantic model.

• Three DHCP scopes: Each VLAN has its own IPv4 subnet. DHCP scopes are subnet-specific, so create one scope for:

• Two DHCP relays: DHCP client discovery begins as a broadcast, and broadcasts do not cross routers or VLAN boundaries. Therefore, configure a DHCP relay on the router or Layer 3 switch interface for each client VLAN.

• User-generated content: precisa ser coletado, filtrado, anonimizado e rotulado.
• Moderation logs: podem conter dados inconsistentes, informações pessoais e decisões que precisam ser revisadas.
• Content moderation guidelines: são regras ou orientações, não dados diretamente utilizáveis para medir o comportamento do modelo.

• Virus signatures: Primarily associated with antivirus or antimalware tools.
• Security agent deployment: Usually handled by endpoint-management or endpoint-security platforms.
• Vulnerability scanning: Performed by vulnerability-assessment tools, although a SIEM may ingest their results.

• Allow only approved MAC addresses
• Limit the number of learned addresses
• Shut down or restrict a port when a violation occurs

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect some attack traffic, but it is not the direct control for limiting MAC addresses on switch ports.
• NGFW: Filters routed network traffic, while this attack targets Layer 2 switch behavior.

• Vulnerability scanner: Identifies technical weaknesses in systems, applications, or devices.
• Penetration test: Simulates attacks to determine whether vulnerabilities can be exploited.
• SCAP (Security Content Automation Protocol): Uses standardized formats and protocols for automated vulnerability, configuration, and compliance checks.
• Illumination tool: Maps and analyzes broader supply-chain exposure and third-party risk.

• The ERSPAN source is the device or interface whose traffic is being copied.
• The ERSPAN destination is the device receiving the encapsulated copy and forwarding it to the traffic analyzer.
• The local monitor session number is locally significant. Therefore, the source and destination do not need matching session IDs such as 47 or 48.
• The erspan-id identifies the ERSPAN stream and must correspond between the source and destination configuration.

• CBWFQ (Class-Based Weighted Fair Queuing): Creates traffic classes and assigns each class a guaranteed bandwidth or queueing treatment.
• PQ (Priority Queuing): Uses multiple queues with strict priority. Higher-priority queues are serviced before lower-priority queues, making it useful for delay-sensitive traffic—but it can starve lower-priority traffic.

• FRTS: Traffic shaping for Frame Relay; it controls the transmission rate rather than selecting packets during congestion.
• CAR: Polices traffic by rate, typically dropping or remarking packets that exceed a limit.
• PBR: Policy-Based Routing; it selects forwarding paths and is not a QoS queueing mechanism.

Statement 1 — Correct

Statement 2 — Correct

• Deficiency found before patient use: usually does not require an adverse-event report because no patient exposure occurred.
• Event caused solely by the patient’s condition: may not be reportable if the device did not contribute.
• Malfunction protection operated correctly: generally exempt when the device’s safety mechanism worked as intended and prevented harm.