Splunk Enterprise Security Certified Analyst — Question 43

A customer has a search cluster (SHC) of six members split evenly between two data centers (DC). The customer is concerned with network connectivity between the two DCs due to frequent outages. Which of the following is true as it relates to SHC resiliency when a network outage occurs between the two DCs?

Answer options

• A. The SHC will function as expected as the SHC deployer will become the new captain until the network communication is restored.
• B. The SHC will stop all scheduled search activity within the SHC.
• C. The SHC will function as expected as the minimum required number of nodes for a SHC is 3.
• D. The SHC will function as expected as the SHC captain will fall back to previous active captain in the remaining site.

Correct answer: B

Explanation

The correct answer is B, as a network outage between the two data centers can lead to the loss of quorum, causing the SHC to stop all scheduled search activities to maintain data integrity. Options A, C, and D are incorrect because they incorrectly suggest that the SHC can continue to function normally without sufficient connectivity and quorum, which is essential for its operation.