Splunk Enterprise Certified Architect Practice Test

What task should the architect perform when building a deployment plan?

1. Use case checklist.

2. Install Splunk apps.

3. Inventory data sources.

4. Review network topology.

The correct answer is: Inventory data sources.

When building a deployment plan, inventorying data sources is a crucial task. Understanding what data will be ingested into Splunk helps architects evaluate the volume, variety, and velocity of the data, which are essential for planning the architecture to handle these inputs efficiently. By inventorying data sources, the architect gains insights into the type of data they'll work with, its structure, and potential performance implications for indexing and search. This assessment allows for informed decisions regarding resource allocation, scalability, and the configuration of forwarders and indexers, ensuring that the architecture will meet the organization's needs. The other tasks, while beneficial in other contexts of planning and implementation, are not as foundational for the deployment plan itself. Reviewing network topology, for instance, would be important for understanding the physical and logical setup of the infrastructure but does not directly address the content or requirements of the data being managed. Similarly, using a use case checklist or installing Splunk apps are tasks more closely tied to specific implementation steps rather than the overall planning phase, making them secondary to the critical first step of understanding the data landscape.