User And Authentication Management

Which file stores the definitions of roles and their associated capabilities?

What is the default role assigned to a new user account if no other role is specified?

A user inherits roles 'RoleA' and 'RoleB'. 'RoleA' has 'srchIndexesAllowed' set to 'index1' and 'RoleB' has it set to 'index2'. What indexes can the user access?

If you want to prevent a user from using the 'delete' command, which capability must be removed from their assigned role?

You are configuring SAML authentication and need to map the 'email' attribute from the Identity Provider to the Splunk 'realName' field. Where do you configure this?

An administrator needs to ensure that users from an LDAP group 'Splunk_Power_Users' are automatically assigned the 'power' role in Splunk. Where is this mapping configured?

You need to restrict a specific user from accessing the 'internal' index even though their assigned role has access to all indexes. How do you implement this restriction?

What happens to a local user account if the underlying LDAP group they belong to is deleted?

An administrator wants to ensure that a specific role cannot search over a time range greater than 24 hours. Where is this limit configured?

Which menu path in Splunk Web is used to manage existing user roles?

Which capability is required for a user to see the 'Settings' menu in Splunk Web?

What happens to a user's session if their role is modified while they are logged in?

How can an administrator monitor failed login attempts for a specific user?

If a user is assigned two roles, 'RoleA' and 'RoleB', and 'RoleA' has 'rtsearch' enabled while 'RoleB' has 'rtsearch' disabled, what is the user's effective capability for real-time searches?

You need to enable multi-factor authentication (MFA) for your Splunk instance. Where is this usually integrated?

You are troubleshooting an issue where a user cannot view a specific dashboard. The user has the 'user' role. What is the most likely cause?

What is the purpose of the 'srchFilter' attribute in a role definition?

Which configuration file is used to map LDAP groups to Splunk roles?

If you want to use SAML authentication, which component must be configured as the 'Service Provider'?

What is the effect of setting 'allow_debug' to false in a role?

Which user account is created by default and intended for administrative use, which should have its default password changed immediately?

Which of the following is a 'capability' in Splunk?

When configuring 'LDAP Strategy', what is the purpose of the 'User Base DN'?

Which TWO of the following are valid ways to authenticate users in Splunk?

Which TWO settings are commonly required when configuring an LDAP strategy?

Which THREE capabilities are typically assigned to a 'Power User'?

Which TWO of the following are true regarding Role Inheritance?

Which TWO items are managed within the 'Access Controls' menu in Splunk Web?

Which TWO items are contained within an 'authorize.conf' role stanza?

Which TWO of the following describe the 'admin' role?

Which THREE parameters must be exchanged between Splunk and an Identity Provider for SAML to work?

Which THREE of these represent common issues when troubleshooting LDAP authentication?

Which THREE of the following are true about the 'can_delete' capability?