User And Authentication Management

Which file stores the definitions of roles and their associated capabilities?

What is the default role assigned to a new user account if no other role is specified?

A user inherits roles 'RoleA' and 'RoleB'. 'RoleA' has 'srchIndexesAllowed' set to 'index1' and 'RoleB' has it set to 'index2'. What indexes can the user access?

If you want to prevent a user from using the 'delete' command, which capability must be removed from their assigned role?

You are configuring SAML authentication and need to map the 'email' attribute from the Identity Provider to the Splunk 'realName' field. Where do you configure this?

Which menu path in Splunk Web is used to manage existing user roles?

What happens to a user's session if their role is modified while they are logged in?

If a user is assigned two roles, 'RoleA' and 'RoleB', and 'RoleA' has 'rtsearch' enabled while 'RoleB' has 'rtsearch' disabled, what is the user's effective capability for real-time searches?

You need to enable multi-factor authentication (MFA) for your Splunk instance. Where is this usually integrated?

You are troubleshooting an issue where a user cannot view a specific dashboard. The user has the 'user' role. What is the most likely cause?

What is the purpose of the 'srchFilter' attribute in a role definition?

If you want to use SAML authentication, which component must be configured as the 'Service Provider'?

What is the effect of setting 'allow_debug' to false in a role?

When configuring 'LDAP Strategy', what is the purpose of the 'User Base DN'?

Which TWO settings are commonly required when configuring an LDAP strategy?

Which THREE capabilities are typically assigned to a 'Power User'?

Which TWO of the following are true regarding Role Inheritance?

Which TWO items are contained within an 'authorize.conf' role stanza?

Which TWO of the following describe the 'admin' role?

Which THREE of these represent common issues when troubleshooting LDAP authentication?

A security analyst at your organization must be able to create and schedule saved searches and alerts, but must NOT be able to install apps or manage other users. You are assigning roles in Splunk Enterprise. Which built-in role should you assign to meet these requirements with least privilege?

You are configuring LDAP authentication for Splunk Enterprise. You want to ensure that users are authenticated against the LDAP directory and that their group memberships are mapped to Splunk roles. Which two configuration settings must you define in authentication.conf to achieve this? (Choose two.)

A user reports that they can log in to Splunk Web but cannot see the 'Settings' menu or access the 'Users' page. You check their roles and find they have the 'user' role. Which capability must you add to a custom role to allow them to manage users?

You are configuring SAML authentication for Splunk Enterprise. You need to ensure that when a user authenticates via SAML, their Splunk roles are assigned based on an attribute sent by the Identity Provider (IdP). Which configuration setting in authentication.conf allows you to map an IdP attribute to Splunk roles?

A security team requires that all Splunk users authenticate through your corporate LDAP directory, but they also need a local break-glass account in case LDAP becomes unreachable. You configure LDAP authentication in Splunk Web. Which action ensures the local administrator account can still log in when the LDAP servers are down?

A Splunk administrator is configuring LDAP authentication and needs to ensure that only users who are members of the 'SplunkAdmins' group in Active Directory can log in. The LDAP strategy has been set up with a User Base DN and a bind account. Which additional setting must be configured to enforce this restriction?

A new Splunk administrator is reviewing user roles and notices that the 'admin' role has the 'edit_roles' capability. What does this capability allow a user to do?

You are an admin for a Splunk Enterprise deployment. You need to create a new user account for a colleague who will only need to search data and create reports, but should not have the ability to change any system settings. Which default Splunk role should you assign to this user?

An administrator needs to allow a group of users to access Splunk Web using their existing Active Directory credentials but wants to avoid storing user passwords in Splunk. Which authentication method should be configured?

A Splunk administrator is troubleshooting why some users are unable to log in after LDAP authentication was configured. The LDAP server is reachable, and the bind account credentials are correct. Which two settings should be verified to ensure that user searches are successful? (Choose two.)

A Splunk administrator is troubleshooting an LDAP authentication issue where users are unable to log in. The administrator confirms that the LDAP server is reachable and the bind credentials are correct. Which Splunk log file should the administrator review to find detailed error messages about the LDAP authentication failure?

A Splunk administrator is configuring SAML authentication for the company's Splunk Enterprise deployment. The Identity Provider (IdP) sends a group attribute named 'memberOf' containing the value 'CN=SplunkPowerUsers,OU=Groups,DC=corp,DC=local'. The administrator needs this group to automatically map to the 'power' role in Splunk. Which configuration file and stanza should the administrator edit to accomplish this?

A Splunk administrator needs to allow a team of contractors to search only the 'contractor_events' index while preventing them from accessing any other index. The administrator creates a new role called 'contractor_role' and assigns the contractors to it. The role must not inherit index access from any other role. Which setting in authorize.conf should the administrator configure to restrict the role to only the 'contractor_events' index?

A Splunk administrator is onboarding a new security analyst who needs to use Splunk Web to create and run searches, save reports, and build dashboards, but must not be able to manage users, edit roles, or install apps. The administrator decides to assign the analyst a built-in role. Which TWO capabilities are included in the 'power' role by default that support this requirement? (Choose two.)

A Splunk administrator is configuring LDAP authentication. The LDAP server requires a bind account to search the directory for user entries. The administrator wants to ensure that if the LDAP server becomes unreachable, users can still log in with their local Splunk accounts. Which setting in authentication.conf should the administrator configure to allow fallback to local authentication?