SPLK-1003 User And Authentication Management Practice Test 2 — 15 Questions

Question 1

You are a Splunk administrator for a large enterprise. A group of users must be able to log into Splunk Web using their existing LDAP credentials. Your LDAP directory stores user accounts under two separate organizational units: ou=employees,dc=example,dc=com and ou=contractors,dc=example,dc=com. You need to configure the LDAP strategy so that users from both organizational units can authenticate. Which two configuration settings must be adjusted to ensure both user populations can be found during authentication? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the User Base DN to dc=example,dc=com and use a User Name Attribute that is unique across both organizational units.. To authenticate users from two separate OUs, you set the User Base DN to the common parent domain so the search covers both OUs, and you ensure the Bind DN service account has read access to both OUs. The User Name Attribute must be unique across the base. This configuration allows a single LDAP strategy to handle both user populations without additional complexity.

Answer

Create two separate LDAP strategies, one for each organizational unit, and assign them to different roles.

Answer

Enable recursive searching and set the User Base DN to dc=example,dc=com.

Answer

Set the User Base DN to ou=employees,dc=example,dc=com and add a second User Base DN for the contractors OU.

Question 2

A Splunk administrator is configuring role-based access control and needs to ensure that a user can only see events from the 'web' index and can create and share reports with other users in the same role. The administrator creates a new role and assigns the necessary capabilities. Which combination of settings should be applied to the role to meet these requirements?

Accepted Answer

Set 'srchIndexesAllowed' to 'web' and assign both 'reporting' and 'share_report' capabilities.. To restrict index access, the role must have 'srchIndexesAllowed' set to 'web'. To enable report creation and sharing, the role requires both the 'reporting' and 'share_report' capabilities. The 'reporting' capability allows users to create reports, while 'share_report' allows them to share reports with others. Assigning both capabilities ensures the user can perform all required actions.

Answer

Set 'srchIndexesAllowed' to 'web' and assign the 'share_report' capability.

Answer

Set 'srchIndexesAllowed' to 'web' and assign the 'reporting' capability.

Answer

Set 'srchIndexesAllowed' to 'web' and assign the 'schedule_search' capability.

Question 3

A user named 'analyst' is a member of the 'power' role. The security team wants to prevent this user from running searches that return more than 100,000 events, but they must not affect other users in the 'power' role. Which configuration should you apply?

Accepted Answer

Create a new role that inherits from 'power', set the 'srchMaxResults' field to 100,000, and assign only this new role to 'analyst'.. The per-role setting 'srchMaxResults' limits the maximum number of events a search can return for users in that role. To apply it only to one user, create a new role that inherits from the existing role, set the limit, and assign only the new role to that user. This preserves capabilities while enforcing the restriction without impacting other members of the original role.

Answer

Create a new role that inherits from 'power', set 'srchDiskQuota' to 100,000, and assign it to 'analyst'.

Answer

Create a new role with the 'srchMaxResults' capability set to 100,000 and assign it to 'analyst' in addition to 'power'.

Answer

Edit the 'power' role and set the 'srchJobsQuota' to 100,000.

Question 4

A Splunk administrator needs to grant a user the ability to create and manage their own saved searches and alerts, but must prevent them from editing or deleting saved searches owned by other users. The user should also be able to share their saved searches with other users. Which built-in role best fits this requirement?

Accepted Answer

power. The power role is designed for users who need to create and manage their own saved searches and alerts and share them with others, without having administrative control over other users' objects. It includes the necessary capabilities such as 'schedule_search' and 'share_search' while not granting edit or delete rights on others' content. This aligns with the stated requirements.

Answer

user

Answer

can_delete

Answer

admin

Question 5

A Splunk administrator is setting up LDAP authentication and needs to ensure that users are correctly mapped to Splunk roles based on their LDAP group memberships. The administrator wants to map the LDAP group 'SplunkUsers' to the Splunk role 'user' and the LDAP group 'SplunkAdmins' to the Splunk role 'admin'. Which two configuration steps are required to achieve this mapping? (Choose two.)

Accepted Answer

Configure the Group Base DN to point to the organizational unit containing the LDAP groups.. To map LDAP groups to Splunk roles, the administrator must configure the Group Base DN to specify where groups are located and define a group filter that includes the desired groups. These steps allow Splunk to retrieve the groups and then map them to roles via the role mapping configuration. Without the correct Group Base DN and group filter, Splunk cannot identify the groups for mapping.

Answer

Create role mappings in Splunk Web under Settings > Authentication > LDAP > Role Mapping.

Answer

Assign the 'admin' role to all LDAP users by default.

Answer

Set the User Base DN to the same organizational unit as the groups.

Question 6

You are configuring LDAP authentication for Splunk Enterprise. The LDAP directory uses a custom schema where user accounts are identified by the attribute 'sAMAccountName' and group membership is stored in the 'memberOf' attribute. Which two settings must you configure in the LDAP strategy to allow users to authenticate and have their roles mapped correctly? (Choose two.)

Accepted Answer

User name attribute set to 'sAMAccountName'.. To authenticate users against a custom LDAP schema, you must map the username attribute to the directory's account identifier, which here is 'sAMAccountName'. For role mapping, Splunk needs to know which attribute holds group memberships; in this directory, that is 'memberOf'. Configuring these two settings allows Splunk to find users and retrieve their groups for role assignment.

Answer

User base DN set to the root of the directory.

Answer

Real name attribute set to 'memberOf'.

Answer

Group base DN set to the same value as the user base DN.

Question 7

You are configuring authentication for Splunk Enterprise using native authentication. You want to enforce a password policy that requires a minimum length of 12 characters, at least one uppercase letter, one lowercase letter, one digit, and one special character. Additionally, you want to lock out a user account after five consecutive failed login attempts. Which configuration file and stanza should you edit to set these parameters?

Accepted Answer

web.conf, [settings] stanza. Password policy and account lockout settings in Splunk Enterprise are configured in web.conf within the [settings] stanza. The parameters include minPasswordLength, minPasswordUppercase, minPasswordLowercase, minPasswordDigit, minPasswordSpecial, and lockoutAttempts. These settings apply to native authentication and are not found in authentication.conf or authorize.conf. Editing web.conf is the correct approach to enforce the described policy.

Answer

authorize.conf, [role_admin] stanza

Answer

authentication.conf, [authentication] stanza

Answer

authentication.conf, [password_policy] stanza

Question 8

A Splunk administrator needs to create a new user account that should have the ability to search all indexes but not perform any administrative tasks. The administrator wants to assign the minimum necessary roles. Which role should be assigned to this user?

Accepted Answer

user. The 'user' role provides the necessary search capabilities without administrative privileges. It allows searching across indexes as configured, and does not include rights to manage users, roles, or system settings. Assigning the 'user' role satisfies the requirement for searching all indexes while adhering to least privilege.

Answer

power

Answer

admin

Answer

can_delete

Question 9

A new Splunk administrator needs to create a user account that can only view dashboards and run real-time searches, but must not be able to create or modify alerts. Which built-in role should be assigned to this user?

Accepted Answer

user. The built-in 'user' role provides the necessary permissions to view dashboards and run real-time searches while explicitly omitting capabilities to create or modify alerts. The 'power' role would allow alert creation, and 'admin' is too permissive. The 'can_delete' is a capability, not a role, so it cannot be assigned directly to a user.

Answer

power

Answer

admin

Answer

can_delete

Question 10

A Splunk administrator is configuring role-based access control and needs to ensure that users in the 'analyst' role can only see events from the 'finance' index when the 'classification' field equals 'internal'. Which configuration should be applied to the role?

Accepted Answer

Set the role's srchIndexesAllowed to finance and add a search filter of classification=internal. To restrict users to only see events from the finance index where classification equals internal, the role must have srchIndexesAllowed set to finance to limit index access, and a search filter of classification=internal to filter events at search time. This ensures that even if users search across all indexes, they only get results from finance that meet the condition.

Answer

Set the role's srchIndexesAllowed to all indexes and add a search filter of index=finance classification=internal

Answer

Set the role's srchIndexesAllowed to finance and add a search filter of index=finance classification=internal

Answer

Set the role's srchIndexesAllowed to finance and add a field filter of classification=internal

Question 11

A Splunk administrator has configured LDAP authentication and mapped the LDAP group 'Splunk_Admins' to the Splunk role 'admin'. A user who is a member of that LDAP group logs in but receives the error 'Your account is disabled' even though the account is active in LDAP. What is the most likely cause?

Accepted Answer

The user's Splunk account was created with the 'disabled' flag set due to a previous local authentication configuration.. When LDAP authentication is active, Splunk still checks for a local user account with the same name. If such an account exists and is disabled, the login is rejected with 'Your account is disabled' even if LDAP authentication succeeds. This often occurs when a user was previously created locally and later disabled. The fix is to remove or enable the local account, or ensure that local accounts are not created for LDAP users.

Answer

The user's Splunk account has been disabled in the local user list.

Answer

The LDAP group 'Splunk_Admins' is not mapped to any Splunk role.

Answer

The user's LDAP account is disabled or locked out.

Question 12

A Splunk administrator configures LDAP authentication and maps an LDAP group to the 'power' role using the 'groupBaseDN' and 'groupMapping' settings. Users in that group can log in but cannot create alerts. The 'power' role normally includes the 'schedule_search' capability. What is the most likely reason for this issue?

Accepted Answer

The 'power' role has been modified to remove the 'schedule_search' capability.. The 'power' role's default capabilities include 'schedule_search'. If users mapped to this role cannot create alerts, the role's capabilities may have been altered. Administrators should verify the role definition in Settings > Roles or via 'authorize.conf' to ensure 'schedule_search' is enabled.

Answer

The LDAP group mapping is not correctly configured, so users are not assigned the 'power' role.

Answer

The users are also members of another LDAP group mapped to a role that denies 'schedule_search'.

Answer

The LDAP strategy is configured to not retrieve group memberships, so users only get default roles.

Question 13

A Splunk administrator is setting up authentication for a new deployment and wants to ensure that user passwords are stored securely. By default, Splunk Enterprise stores user credentials in which file, and what mechanism does it use to protect the passwords?

Accepted Answer

passwd file in $SPLUNK_HOME/etc/passwd, using SHA-512 hashes with a salt. Splunk Enterprise maintains local user accounts in the passwd file under $SPLUNK_HOME/etc/passwd. Each password is hashed with SHA-512 and a per-user salt, which is a robust method for credential storage. This file is distinct from authentication.conf, which configures external authentication methods. Administrators should secure this file and avoid manual edits.

Answer

passwd file, using salted SHA-512 hashes

Answer

authentication.conf, using encrypted passwords with a shared secret

Answer

passwd file in $SPLUNK_HOME/etc/passwd, using MD5 hashes

Question 14

Which file stores the definitions of roles and their associated capabilities?

Accepted Answer

authorize.conf. authorize.conf is the Splunk configuration file that defines roles and the capabilities assigned to each role. Each role is a stanza in authorize.conf, and within that stanza the 'capabilities' and 'importRoles' keys determine what the role can do. This is the authoritative file for role-based access control definitions on a Splunk instance.

Answer

indexes.conf

Answer

authentication.conf

Answer

limits.conf

Question 15

What is the default role assigned to a new user account if no other role is specified?

Accepted Answer

user. In Splunk, when a new user account is created without explicitly assigning any role, the system automatically assigns the 'user' role by default. This role provides basic capabilities such as running searches, creating and managing their own saved searches, and using the Splunk Web interface, but it does not grant administrative privileges or the ability to delete data. The 'user' role is the standard starting point for most non-admin users.

Answer

admin

Answer

power

Answer

can_delete