Splunk Certified Cybersecurity Defense Architect Practice Questions - Splunk Certified Cybersecurity Defense Architect (SPLK-5003) Exam

Access More Questions

An enterprise SOC architect is designing a Splunk Enterprise Security deployment that must ingest 5 TB/day of security data with sub-second notable event creation. Which deployment topology BEST meets these requirements?

Single-instance ES on a stand-alone search head with co-located indexer Distributed deployment with an indexer cluster, dedicated ES search head (or SHC), and separate forwarder tier All-in-one indexer/search head pair plus universal forwarders only Single indexer with a search head pool

Correct Answer:

Distributed deployment with an indexer cluster, dedicated ES search head (or SHC), and separate forwarder tier

Access more questions from this quiz

Continue to Splunk Certified Cybersecurity Defense Architect Practice Questions - Splunk Certified Cybersecurity Defense Architect (SPLK-5003) Exam for more practice questions and the full quiz experience.

Access More Questions