Splunk Enterprise Security Certified Admin — Question 2

Which of the following is a risk of using the Auto Deployment feature of Distributed Configuration Management to distribute indexes.conf?

Answer options

• A. Indexers might crash.
• B. Indexers might be processing.
• C. Indexers might not be reachable.
• D. Indexers have different settings.

Correct answer: D

Explanation

The correct answer is D because using the Auto Deployment feature can lead to indexers having inconsistent settings, which can cause issues in data processing and retrieval. Options A, B, and C are not direct risks associated with the deployment of configuration files, as they pertain to operational states rather than configuration discrepancies.