Splunk Splunk ES Admin Practice Test

Splunk ES Admin practice test: what's covered

• Splunk Enterprise Security Certified Admin

Free Splunk ES Admin sample questions

1. A customer wants to deploy Splunk Enterprise Security to ingest ~500 GB/day with 6 indexers in an indexer cluster. Which deployment topology is BEST for Enterprise Security?

   • A. Install ES on the cluster master
   • B. Install ES on a dedicated search head (or search head cluster) that has distributed search to the indexer cluster — never on indexers or the cluster master
   • C. Install ES on each indexer for parallelism
   • D. Install ES on a heavy forwarder
   Show answer

   Correct: B. ES is a search-head-tier app. It MUST run on a dedicated search head or a search head cluster, never on indexers, cluster master, or heavy forwarders. Installing it on an indexer or cluster master is unsupported and breaks upgrades. The dedicated SH connects to the indexer cluster via distributed search.

2. You are running ES on a single search head and need to scale to support more concurrent analyst sessions and higher correlation-search throughput. What is the recommended next step?

   • A. Add more CPU/RAM to the single search head indefinitely
   • B. Migrate to a Search Head Cluster (SHC) of 3+ members with the deployer pushing the ES app, and use captain election for scheduled searches
   • C. Install ES on the indexers
   • D. Use a load balancer in front of two independent search heads with no SHC
   Show answer

   Correct: B. Vertical scaling stops paying off — the supported scale-out path for ES is a Search Head Cluster. The SHC deployer pushes ES (via the apps bundle), and the captain coordinates scheduled correlation searches so they do not all fire on every member.

3. Which TWO statements are TRUE about installing Splunk Enterprise Security in a Search Head Cluster deployment? (Choose 2)

   • A. ES must be installed on each SHC member by hand
   • B. ES is deployed via the SHC deployer using the apps bundle (splunk apply shcluster-bundle)
   • C. KV store collections used by ES are replicated automatically across SHC members
   • D. KV store collections require manual export/import per member
   • E. ES cannot be used with SHC
   Show answer

   Correct: B and C. ES installs once on the deployer and is pushed to all SHC members via shcluster-bundle. KV store (which backs notables, investigations, threat artifacts, etc.) replicates between members automatically. Manual per-member install would drift and break replication.

4. After installing ES on the search head, which special index is automatically created and used to store notable events generated by correlation searches?

   • A. main
   • B. notable
   • C. summary
   • D. risk
   Show answer

   Correct: B. ES creates several internal indexes: notable (notable events), risk (RBA risk events), threat_activity (TI matches), endpoint, etc. Notables are written to the "notable" index via the "Notable" adaptive response action of a correlation search. summary is for accelerated/summary searches, not notables.

5. An ES analyst wants the FASTEST search across millions of authentication events. Which SPL form is the recommended ES pattern?

   • A. <pre>index=* sourcetype=linux_secure OR sourcetype=WinEventLog:Security | stats count by user</pre>
   • B. <pre>| datamodel Authentication Authentication search | stats count by Authentication.user</pre>
   • C. <pre>| from datamodel:"Authentication" | stats count by user</pre>
   • D. <pre>| tstats count from datamodel=Authentication by Authentication.user</pre>
   Show answer

   Correct: D. tstats against an ACCELERATED data model reads only the tsidx summaries and is dramatically faster than raw search. "| datamodel ... search" works but is much slower because it reads raw events. CIM-compliant sourcetypes feeding an accelerated DM is the ES golden pattern. tstats is the right tool when the data model is accelerated.

Last updated: 2026-10-19

Splunk ES Admin practice test FAQ

Related practice tests

• Splunk SPLK-1002 practice test
• Splunk SPLK-1001 practice test
• Splunk Splunk Admin practice test
• Splunk SOAR-DEV practice test