Splunk Enterprise Security Certified Analyst — Question 62

What happens when an index cluster peer freezes a bucket?

Answer options

• A. All indexers with a copy of the bucket will delete it.
• B. The cluster master will ensure another copy of the bucket is made on the other peers to meet the replication settings.
• C. The cluster master will no longer perform fix-up activities for the bucket.
• D. All indexers with a copy of the bucket will immediately roll it to frozen.

Correct answer: C

Explanation

The correct answer is C because when a bucket is frozen, the cluster master halts any maintenance or fix-up actions for that bucket. Option A is incorrect since the bucket is not deleted; option B is wrong as replication does not occur for frozen buckets; and option D is misleading because rolling to frozen is not an immediate action performed by indexers.