SPLK-1003 User And Authentication Management — 20 Questions

Question 1

Which file stores the definitions of roles and their associated capabilities?

Accepted Answer

authorize.conf. authorize.conf is the configuration file that manages roles and capabilities.

Answer

indexes.conf

Answer

authentication.conf

Answer

limits.conf

Question 2

What is the default role assigned to a new user account if no other role is specified?

Accepted Answer

user. The 'user' role is the default role assigned to new accounts.

Answer

admin

Answer

power

Answer

can_delete

Question 3

A user inherits roles 'RoleA' and 'RoleB'. 'RoleA' has 'srchIndexesAllowed' set to 'index1' and 'RoleB' has it set to 'index2'. What indexes can the user access?

Accepted Answer

Both index1 and index2.. When roles are combined, the cumulative set of allowed indexes is the union of all indexes allowed by all assigned roles.

Answer

Only index1.

Answer

Only index2.

Answer

No indexes.

Question 4

If you want to prevent a user from using the 'delete' command, which capability must be removed from their assigned role?

Accepted Answer

delete. The 'delete' capability is required to run the 'delete' search command.

Answer

edit_search

Answer

can_delete_data

Answer

admin_all_objects

Question 5

You are configuring SAML authentication and need to map the 'email' attribute from the Identity Provider to the Splunk 'realName' field. Where do you configure this?

Accepted Answer

SAML Configuration in Splunk Web.. The SAML attribute mapping is defined in the SAML configuration within the Splunk Web UI under Access Controls > Authentication Method.

Answer

server.conf

Answer

authorize.conf

Answer

web.conf

Question 6

An administrator needs to ensure that users from an LDAP group 'Splunk_Power_Users' are automatically assigned the 'power' role in Splunk. Where is this mapping configured?

Accepted Answer

In authentication.conf within the [roleMap_LDAP_name] stanza.. LDAP group mapping is configured in the Authentication Method settings under 'Role mapping'.

Answer

In authorize.conf under the [role_power] stanza.

Answer

In user-prefs.conf.

Answer

In distsearch.conf.

Question 7

You need to restrict a specific user from accessing the 'internal' index even though their assigned role has access to all indexes. How do you implement this restriction?

Accepted Answer

Create a new role with 'srchIndexesAllowed' excluding 'internal' and assign this role to the user.. You must create a new role that explicitly excludes the 'internal' index in the 'srchIndexesAllowed' field and assign it to the user.

Answer

Use a 'blacklist' in authorize.conf for the specific user.

Answer

Modify the user's account and set the indexes access to 'none'.

Answer

Set the 'allow_index_access' capability to false for the user.

Question 8

What happens to a local user account if the underlying LDAP group they belong to is deleted?

Accepted Answer

The user will be unable to authenticate via LDAP.. The local Splunk user object remains, but if authentication is tied exclusively to the LDAP group, the user will be unable to log in.

Answer

The user can still log in using their previous password.

Answer

The user account is automatically deleted from Splunk.

Answer

The user is automatically promoted to the 'admin' role.

Question 9

An administrator wants to ensure that a specific role cannot search over a time range greater than 24 hours. Where is this limit configured?

Accepted Answer

authorize.conf. The 'srchTimeWin' attribute in the role definition within authorize.conf restricts the maximum search time window.

Answer

limits.conf

Answer

server.conf

Answer

authentication.conf

Question 10

Which menu path in Splunk Web is used to manage existing user roles?

Accepted Answer

Settings > Access controls > Roles. Settings > Access controls > Roles is the path to manage roles.

Answer

Settings > Authentication method

Answer

Settings > Server settings

Answer

Settings > Access controls > Users

Question 11

Which capability is required for a user to see the 'Settings' menu in Splunk Web?

Accepted Answer

edit_settings. The 'edit_settings' capability is required to access and modify settings in Splunk Web.

Answer

user

Answer

can_view_settings

Answer

admin

Question 12

What happens to a user's session if their role is modified while they are logged in?

Accepted Answer

The user must log out and back in for changes to take effect.. Changes to a user's role permissions take effect only upon the next login (or session refresh).

Answer

The changes are applied immediately to their current session.

Answer

The user's session is terminated after 5 minutes.

Answer

The user is forced to log out immediately.

Question 13

How can an administrator monitor failed login attempts for a specific user?

Accepted Answer

Search the 'audit' index for sourcetype 'splunkd_access'.. Failed login attempts are recorded in the 'audit' index under the 'splunkd_access.log' source.

Answer

Review the 'user-prefs.conf' file.

Answer

Check the 'internal' index for 'User management' events.

Answer

Use the 'splunk login-history' CLI command.

Question 14

If a user is assigned two roles, 'RoleA' and 'RoleB', and 'RoleA' has 'rtsearch' enabled while 'RoleB' has 'rtsearch' disabled, what is the user's effective capability for real-time searches?

Accepted Answer

The user can perform real-time searches.. Capabilities in Splunk are additive; if any assigned role has the capability, the user possesses that capability.

Answer

The user can only perform real-time searches on index 'main'.

Answer

The user cannot perform real-time searches.

Answer

The user is prompted to choose which role to act as.

Question 15

You need to enable multi-factor authentication (MFA) for your Splunk instance. Where is this usually integrated?

Accepted Answer

Via SAML integration with an Identity Provider.. MFA is typically integrated through the SAML Identity Provider, or via Duo Security integration if using the specific Splunk plugin.

Answer

In user-prefs.conf

Answer

Inside authorize.conf

Answer

By modifying the 'admin' user account in the CLI.

Question 16

You are troubleshooting an issue where a user cannot view a specific dashboard. The user has the 'user' role. What is the most likely cause?

Accepted Answer

The object permissions for the dashboard are not set to 'Global' or the user's role.. The user likely lacks read access to the 'App' or 'Dashboard' object in the context of the app's permissions.

Answer

The user does not have the 'admin' role.

Answer

The index used in the search is not allowed.

Answer

The user has too many roles assigned.

Question 17

What is the purpose of the 'srchFilter' attribute in a role definition?

Accepted Answer

To automatically prepend a filter to all searches performed by the user.. The 'srchFilter' adds a hidden search filter to all searches run by the user to ensure data isolation.

Answer

To restrict which indexes a user can see.

Answer

To block specific users from the system.

Answer

To limit the number of results returned.

Question 18

Which configuration file is used to map LDAP groups to Splunk roles?

Accepted Answer

authentication.conf. Authentication.conf contains the role mapping logic for LDAP strategies.

Answer

ldap.conf

Answer

web.conf

Answer

authorize.conf

Question 19

If you want to use SAML authentication, which component must be configured as the 'Service Provider'?

Accepted Answer

The Splunk Instance.. The Splunk instance itself acts as the Service Provider (SP) in the SAML handshake.

Answer

The browser.

Answer

The Identity Provider (IdP).

Answer

The LDAP Server.

Question 20

What is the effect of setting 'allow_debug' to false in a role?

Accepted Answer

The user cannot use the debug tools in the search bar.. The 'allow_debug' capability enables the use of the debug tools in the search bar. Disabling it restricts this functionality.

Answer

The user cannot log in.

Answer

The user cannot export data.

Answer

The user cannot save searches.