Splunk Enterprise Certified Architect — Question 73

Which of the following is true for a KV Store lookup, but not true for a CSV lookup?

Answer options

• A. KV Store lookups support row-level RBAC.
• B. KV Store lookups can be owned by multiple users.
• C. KV Store lookups are always replicated to indexers as part of the knowledge bundle.
• D. KV Store lookups can be updated without replacing the entire lookup.

Correct answer: D

Explanation

The correct answer is D because KV Store lookups allow for updates to individual entries without having to replace the whole dataset, which is not the case with CSV lookups. Options A, B, and C are not accurate as they pertain to functionality that is not exclusive to KV Store lookups in comparison to CSV lookups.