SPLK-1003 User And Authentication Management — 20 Questions

Question 1

An administrator needs to ensure that users from an LDAP group 'Splunk_Power_Users' are automatically assigned the 'power' role in Splunk. Where is this mapping configured?

Accepted Answer

In authentication.conf within the [roleMap_LDAP_name] stanza.. In Splunk, LDAP group-to-role mapping is configured in authentication.conf inside a stanza named [roleMap_<LDAP_strategy_name>], where each key is the LDAP group DN and the value is a comma-separated list of Splunk roles. This stanza tells Splunk which roles to grant when a user authenticates via LDAP and belongs to that group. The mapping is applied at login time, so users in 'Splunk_Power_Users' automatically receive the 'power' role.

Answer

In authorize.conf under the [role_power] stanza.

Answer

In user-prefs.conf.

Answer

In distsearch.conf.

Question 2

You need to restrict a specific user from accessing the 'internal' index even though their assigned role has access to all indexes. How do you implement this restriction?

Accepted Answer

Create a new role with 'srchIndexesAllowed' excluding 'internal' and assign this role to the user.. In Splunk, index access is controlled at the role level via the srchIndexesAllowed and srchIndexesDefault settings in authorize.conf, not at the individual user level. To restrict a user from the 'internal' index, you must create a new role whose srchIndexesAllowed list explicitly excludes 'internal' (or uses a wildcard with an exclusion), then assign that role to the user. Since Splunk merges permissions across all roles a user holds, the user must not retain any other role that grants access to 'internal'.

Answer

Use a 'blacklist' in authorize.conf for the specific user.

Answer

Modify the user's account and set the indexes access to 'none'.

Answer

Set the 'allow_index_access' capability to false for the user.

Question 3

What happens to a local user account if the underlying LDAP group they belong to is deleted?

Accepted Answer

The user will be unable to authenticate via LDAP.. When a local Splunk user account is mapped to an LDAP group, authentication is delegated to the LDAP directory. If that LDAP group is deleted, the user's group membership can no longer be resolved during authentication, so the LDAP bind/authorization step fails and the user cannot log in. The local account entry may still exist in Splunk, but it is effectively orphaned because its authentication source is gone.

Answer

The user can still log in using their previous password.

Answer

The user account is automatically deleted from Splunk.

Answer

The user is automatically promoted to the 'admin' role.

Question 4

An administrator wants to ensure that a specific role cannot search over a time range greater than 24 hours. Where is this limit configured?

Accepted Answer

authorize.conf. In Splunk, the limit on search time range for a role is configured in authorize.conf. Specifically, the role can have a setting called 'srchTimeWin' (search time window) that restricts the maximum time range a user can search over. This is set in the role definition within authorize.conf. limits.conf contains various search limits but not role-specific time range restrictions. server.conf is for server settings, and authentication.conf is for authentication configuration.

Answer

limits.conf

Answer

server.conf

Answer

authentication.conf

Question 5

Which capability is required for a user to see the 'Settings' menu in Splunk Web?

Accepted Answer

edit_settings. The edit_settings capability is what grants a user access to the Settings menu in Splunk Web. This capability is typically assigned to roles that need to modify system-level configurations such as authentication, indexes, and server settings. Without edit_settings, a user will not see the Settings menu even if they hold other administrative capabilities.

Answer

user

Answer

can_view_settings

Answer

admin

Question 6

How can an administrator monitor failed login attempts for a specific user?

Accepted Answer

Search the 'audit' index for sourcetype 'splunkd_access'.. Splunk records authentication events, including failed login attempts, in the audit index. The splunkd_access sourcetype captures HTTP access activity against splunkd, which includes login attempts to Splunk Web and the REST API, making it the correct place to search for failed logins tied to a specific user.

Answer

Review the 'user-prefs.conf' file.

Answer

Check the 'internal' index for 'User management' events.

Answer

Use the 'splunk login-history' CLI command.

Question 7

Which configuration file is used to map LDAP groups to Splunk roles?

Accepted Answer

authentication.conf. The authentication.conf file is used to configure authentication strategies in Splunk, including LDAP. Within authentication.conf, you define the LDAP strategy and use the groupBaseDN, groupMappingAttribute, and related settings to map LDAP groups to Splunk roles. This is the correct file for LDAP group-to-role mapping.

Answer

ldap.conf

Answer

web.conf

Answer

authorize.conf

Question 8

Which user account is created by default and intended for administrative use, which should have its default password changed immediately?

Accepted Answer

admin. The 'admin' account is the built-in administrative user created during Splunk installation, with full access to all Splunk features and settings. It is intended for initial setup and administrative tasks, and Splunk strongly recommends changing its default password immediately after installation to prevent unauthorized access.

Answer

root

Answer

manager

Answer

splunk-system

Question 9

Which of the following is a 'capability' in Splunk?

Accepted Answer

edit_own_objects. In Splunk, a 'capability' is a granular permission that can be assigned to roles to control access to specific features or actions. Capabilities use lowercase with underscores (e.g., edit_own_objects, search, schedule_search). 'edit_own_objects' is a valid capability that allows a user to edit objects they own, such as saved searches, reports, and dashboards. The other options are not capabilities: SAML_Auth is an authentication method, Modify User is an action (not a capability), and View Index is not a defined capability (the actual capability is 'indexes_edit' or similar).

Answer

SAML_Auth

Answer

Modify User.

Answer

View Index.

Question 10

Which TWO of the following are valid ways to authenticate users in Splunk?

Accepted Answer

Internal Splunk authentication. Internal Splunk authentication (A) is valid because Splunk Enterprise can natively store and validate user credentials in its own authentication system, with users and roles managed via Splunk Web or the CLI (e.g., splunk add user). LDAP (E) is also valid because Splunk supports LDAP as an external authentication method, allowing it to bind to a directory server and authenticate users against directory entries, configured under Settings > Authentication method or in authentication.conf. RADIUS (B) is not among the marked correct answers here, and DNS-based auth (C) is not a real authentication mechanism—DNS resolves names, it does not verify credentials. SQL database lookup (D) is likewise not a supported Splunk authentication method; Splunk can use databases as data sources or lookup tables, but not as an authentication provider.

Answer

RADIUS

Answer

DNS-based auth

Answer

SQL database lookup

Question 11

Which TWO items are managed within the 'Access Controls' menu in Splunk Web?

Accepted Answer

Users. In Splunk Web, the Settings > Access Controls menu is where you manage authentication and authorization objects, and it contains the Users page (option A) for creating accounts, assigning credentials, and mapping users to roles, as well as the Roles page (option C) for defining capabilities, index-level permissions, and role inheritance. Both A and C are correct because user accounts and roles are the two core identity objects governed by Splunk's access control framework. Option B (Deployment server status) is monitored under Settings > Distributed Management or the Monitoring Console, not Access Controls. Option D (Index volume settings) is configured under Settings > Indexes, and option E (Saved search scheduling) is configured in the Searches, Reports, and Alerts page, so neither belongs to the Access Controls menu.

Answer

Deployment server status

Answer

Index volume settings

Answer

Saved search scheduling

Question 12

Which THREE parameters must be exchanged between Splunk and an Identity Provider for SAML to work?

Accepted Answer

SP Metadata XML. For SAML to work between Splunk (the Service Provider) and an Identity Provider, the SP Metadata XML (option A) must be exchanged because it contains the SP's Entity ID, Assertion Consumer Service (ACS) URL, and signing certificate needed by the IdP to validate and route assertions. The SSL Certificate (option C) is required so the IdP and SP can sign and verify SAML assertions and establish trust, typically via X.509 certificates embedded in the metadata. The Entity ID (option E) is a unique identifier for the SP that the IdP uses to recognize the relying party and match the correct SAML configuration. Option B (LDAP Bind Password) is incorrect because SAML authentication does not use LDAP binds; LDAP is a separate authentication method. Option D (Splunk license key) is irrelevant to SAML federation and is never exchanged with an IdP.

Answer

LDAP Bind Password

Answer

The Splunk license key.

Question 13

Which THREE of the following are true about the 'can_delete' capability?

Accepted Answer

It allows the use of the 'delete' command.. Option C is correct because the 'can_delete' capability is exactly what grants a role the ability to run the SPL 'delete' command to remove indexed events from search results. Option D is correct because the 'delete' command only marks events as deleted in the index; the underlying bucket data is not physically removed, so disk space is not reclaimed until the indexer later rolls and retires the bucket. Option E is correct because Splunk's built-in 'admin' role includes the 'can_delete' capability by default, along with most other capabilities. Option A is not correct because 'can_delete' is a Splunk role capability, not an LDAP administrative privilege, and LDAP admin rights are unrelated to running the delete command. Option B is not correct because deleting a Splunk license is a licensing/configuration action performed by a license manager or admin, not something governed by the 'can_delete' capability.

Answer

It requires the user to be an LDAP admin.

Answer

It allows a user to delete the Splunk license.

Question 14

A security team needs to delegate user management to a junior Splunk administrator without granting them full admin rights. Which role should be assigned to allow creating and managing user accounts while still restricting them from changing system-wide configurations?

Accepted Answer

A custom role with only the edit_user capability. The principle of least privilege requires granting only the permissions needed to perform a specific job function. A custom role containing just the edit_user capability allows user account management while preventing changes to critical system settings. Built-in roles like admin or power include extra capabilities that exceed the requirement, and the user role lacks the necessary permission entirely.

Answer

user

Answer

admin

Answer

power

Question 15

You are an admin for a Splunk Enterprise deployment with LDAP authentication enabled. A user reports that they can log in to Splunk Web with their LDAP credentials, but their assigned roles are not being applied; they only have the default user role. Other LDAP users are correctly receiving their roles. You verify that the user's LDAP group membership is correct in the directory. What is the most likely cause?

Accepted Answer

The LDAP group name in Splunk's role mapping does not exactly match the group's distinguished name (DN) or common name (CN) as returned by the LDAP server.. Splunk role mapping for LDAP relies on exact string matching between the group name configured in Splunk and the group identifier returned by the LDAP server. A mismatch in case, DN vs. CN, or whitespace prevents the role from being assigned. Since other users are unaffected, the problem is isolated to this user's group configuration.

Answer

The user's LDAP password has expired, causing role mapping to be skipped.

Answer

The LDAP strategy is configured to use a bind account that lacks permissions to read group membership attributes.

Answer

The user has not been assigned any roles directly in Splunk, and LDAP group mapping is disabled by default.

Question 16

You are a Splunk administrator for a large enterprise. A group of users must be able to log into Splunk Web using their existing LDAP credentials. Your LDAP directory stores user accounts under two separate organizational units: ou=employees,dc=example,dc=com and ou=contractors,dc=example,dc=com. You need to configure the LDAP strategy so that users from both organizational units can authenticate. Which two configuration settings must be adjusted to ensure both user populations can be found during authentication? (Choose two.)

Accepted Answer

Set the User Base DN to dc=example,dc=com and use a User Name Attribute that is unique across both organizational units.. To authenticate users from two separate OUs, you set the User Base DN to the common parent domain so the search covers both OUs, and you ensure the Bind DN service account has read access to both OUs. The User Name Attribute must be unique across the base. This configuration allows a single LDAP strategy to handle both user populations without additional complexity.

Answer

Create two separate LDAP strategies, one for each organizational unit, and assign them to different roles.

Answer

Enable recursive searching and set the User Base DN to dc=example,dc=com.

Answer

Set the User Base DN to ou=employees,dc=example,dc=com and add a second User Base DN for the contractors OU.

Question 17

A Splunk administrator is configuring role-based access control and needs to ensure that a user can only see events from the 'web' index and can create and share reports with other users in the same role. The administrator creates a new role and assigns the necessary capabilities. Which combination of settings should be applied to the role to meet these requirements?

Accepted Answer

Set 'srchIndexesAllowed' to 'web' and assign both 'reporting' and 'share_report' capabilities.. To restrict index access, the role must have 'srchIndexesAllowed' set to 'web'. To enable report creation and sharing, the role requires both the 'reporting' and 'share_report' capabilities. The 'reporting' capability allows users to create reports, while 'share_report' allows them to share reports with others. Assigning both capabilities ensures the user can perform all required actions.

Answer

Set 'srchIndexesAllowed' to 'web' and assign the 'share_report' capability.

Answer

Set 'srchIndexesAllowed' to 'web' and assign the 'reporting' capability.

Answer

Set 'srchIndexesAllowed' to 'web' and assign the 'schedule_search' capability.

Question 18

A user named 'analyst' is a member of the 'power' role. The security team wants to prevent this user from running searches that return more than 100,000 events, but they must not affect other users in the 'power' role. Which configuration should you apply?

Accepted Answer

Create a new role that inherits from 'power', set the 'srchMaxResults' field to 100,000, and assign only this new role to 'analyst'.. The per-role setting 'srchMaxResults' limits the maximum number of events a search can return for users in that role. To apply it only to one user, create a new role that inherits from the existing role, set the limit, and assign only the new role to that user. This preserves capabilities while enforcing the restriction without impacting other members of the original role.

Answer

Create a new role that inherits from 'power', set 'srchDiskQuota' to 100,000, and assign it to 'analyst'.

Answer

Create a new role with the 'srchMaxResults' capability set to 100,000 and assign it to 'analyst' in addition to 'power'.

Answer

Edit the 'power' role and set the 'srchJobsQuota' to 100,000.

Question 19

A Splunk administrator needs to grant a user the ability to create and manage their own saved searches and alerts, but must prevent them from editing or deleting saved searches owned by other users. The user should also be able to share their saved searches with other users. Which built-in role best fits this requirement?

Accepted Answer

power. The power role is designed for users who need to create and manage their own saved searches and alerts and share them with others, without having administrative control over other users' objects. It includes the necessary capabilities such as 'schedule_search' and 'share_search' while not granting edit or delete rights on others' content. This aligns with the stated requirements.

Answer

user

Answer

can_delete

Answer

admin

Question 20

A Splunk administrator is setting up LDAP authentication and needs to ensure that users are correctly mapped to Splunk roles based on their LDAP group memberships. The administrator wants to map the LDAP group 'SplunkUsers' to the Splunk role 'user' and the LDAP group 'SplunkAdmins' to the Splunk role 'admin'. Which two configuration steps are required to achieve this mapping? (Choose two.)

Accepted Answer

Configure the Group Base DN to point to the organizational unit containing the LDAP groups.. To map LDAP groups to Splunk roles, the administrator must configure the Group Base DN to specify where groups are located and define a group filter that includes the desired groups. These steps allow Splunk to retrieve the groups and then map them to roles via the role mapping configuration. Without the correct Group Base DN and group filter, Splunk cannot identify the groups for mapping.

Answer

Create role mappings in Splunk Web under Settings > Authentication > LDAP > Role Mapping.

Answer

Assign the 'admin' role to all LDAP users by default.

Answer

Set the User Base DN to the same organizational unit as the groups.