SPLK-1003 User And Authentication Management Practice Test 3 — 15 Questions

Question 1

A user inherits roles 'RoleA' and 'RoleB'. 'RoleA' has 'srchIndexesAllowed' set to 'index1' and 'RoleB' has it set to 'index2'. What indexes can the user access?

Accepted Answer

Both index1 and index2.. When a user inherits multiple roles, the permissions are additive — the user receives the union of all granted permissions. RoleA allows index1 and RoleB allows index2, so the user can search both index1 and index2. Splunk does not require a single role to grant all access; it merges srchIndexesAllowed across all effective roles.

Answer

Only index1.

Answer

Only index2.

Answer

No indexes.

Question 2

If you want to prevent a user from using the 'delete' command, which capability must be removed from their assigned role?

Accepted Answer

delete. In Splunk, the 'delete' command is controlled by the 'delete' capability. This capability allows a user to use the delete command to remove events from indexes. To prevent a user from using the delete command, you must remove the 'delete' capability from their role. Other capabilities like edit_search, can_delete_data, and admin_all_objects do not directly govern the delete command.

Answer

edit_search

Answer

can_delete_data

Answer

admin_all_objects

Question 3

You are configuring SAML authentication and need to map the 'email' attribute from the Identity Provider to the Splunk 'realName' field. Where do you configure this?

Accepted Answer

SAML Configuration in Splunk Web.. SAML attribute mapping (including mapping the IdP's 'email' attribute to Splunk's realName field) is configured in the SAML Configuration page under Settings > Authentication Method in Splunk Web. This UI writes the mapping to authentication.conf.

Answer

server.conf

Answer

authorize.conf

Answer

web.conf

Question 4

Which menu path in Splunk Web is used to manage existing user roles?

Accepted Answer

Settings > Access controls > Roles. In Splunk Web, user roles are managed under Settings > Access controls > Roles. This menu path allows administrators to create, edit, and delete roles, as well as assign capabilities and index permissions. It is the central location for role-based access control configuration.

Answer

Settings > Authentication method

Answer

Settings > Server settings

Answer

Settings > Access controls > Users

Question 5

What happens to a user's session if their role is modified while they are logged in?

Accepted Answer

The user must log out and back in for changes to take effect.. In Splunk, role and permission changes are not dynamically applied to an already-authenticated session. The user's session retains the permissions and role assignments that were in effect at the time of login, so the user must log out and log back in for the modified role to take effect. This is because Splunk caches role information in the session token at authentication time.

Answer

The changes are applied immediately to their current session.

Answer

The user's session is terminated after 5 minutes.

Answer

The user is forced to log out immediately.

Question 6

If a user is assigned two roles, 'RoleA' and 'RoleB', and 'RoleA' has 'rtsearch' enabled while 'RoleB' has 'rtsearch' disabled, what is the user's effective capability for real-time searches?

Accepted Answer

The user can perform real-time searches.. In Splunk's role-based access control, capabilities are additive across all roles assigned to a user. If any one role grants a capability, the user effectively has that capability, even if another role does not grant it. Since RoleA has rtsearch enabled, the user can perform real-time searches regardless of RoleB's setting.

Answer

The user can only perform real-time searches on index 'main'.

Answer

The user cannot perform real-time searches.

Answer

The user is prompted to choose which role to act as.

Question 7

You need to enable multi-factor authentication (MFA) for your Splunk instance. Where is this usually integrated?

Accepted Answer

Via SAML integration with an Identity Provider.. Splunk does not natively implement MFA; instead, it delegates authentication to an external Identity Provider (IdP) via SAML. When SAML is configured, Splunk acts as a Service Provider (SP), and the IdP handles the actual authentication, including MFA enforcement. This is the standard and recommended approach for enabling MFA in Splunk.

Answer

In user-prefs.conf

Answer

Inside authorize.conf

Answer

By modifying the 'admin' user account in the CLI.

Question 8

You are troubleshooting an issue where a user cannot view a specific dashboard. The user has the 'user' role. What is the most likely cause?

Accepted Answer

The object permissions for the dashboard are not set to 'Global' or the user's role.. The most likely cause for a user with the 'user' role being unable to view a specific dashboard is that the object permissions for the dashboard are not set to 'Global' or to the user's role. In Splunk, dashboards (and other knowledge objects) have permissions that control which roles can view or edit them. If the dashboard is private or shared only with specific roles that do not include 'user', the user cannot see it. The 'user' role does not need 'admin' role to view dashboards. Index permissions (B) would affect search results but not the ability to view the dashboard itself. Having too many roles (C) is not a cause.

Answer

The user does not have the 'admin' role.

Answer

The index used in the search is not allowed.

Answer

The user has too many roles assigned.

Question 9

What is the purpose of the 'srchFilter' attribute in a role definition?

Accepted Answer

To automatically prepend a filter to all searches performed by the user.. The 'srchFilter' attribute in a role definition automatically prepends a filter to all searches performed by users with that role. This is used to enforce row-level security, such as restricting results to a specific index, sourcetype, or field value. For example, setting srchFilter = host=web* ensures users only see events from web hosts. It does not restrict index visibility (that's done via index permissions) or limit result counts.

Answer

To restrict which indexes a user can see.

Answer

To block specific users from the system.

Answer

To limit the number of results returned.

Question 10

If you want to use SAML authentication, which component must be configured as the 'Service Provider'?

Accepted Answer

The Splunk Instance.. In SAML authentication, the Splunk instance acts as the Service Provider (SP) — it receives SAML assertions from the Identity Provider (IdP) and grants access based on those assertions. Splunk's SAML configuration (via authentication.conf and the SAML settings in Splunk Web) defines the SP entity ID, ACS URL, and IdP metadata. The IdP is the external identity system (such as Okta, Microsoft Entra ID, or ADFS) that authenticates users and issues assertions.

Answer

The browser.

Answer

The Identity Provider (IdP).

Answer

The LDAP Server.

Question 11

What is the effect of setting 'allow_debug' to false in a role?

Accepted Answer

The user cannot use the debug tools in the search bar.. The 'allow_debug' setting in a role controls whether users with that role can access the debug tools (such as the 'Debug' option in the search bar that shows the search job inspector and other diagnostics). Setting it to false disables those debug features for the role. It does not affect login, export, or saving searches, which are governed by separate capabilities.

Answer

The user cannot log in.

Answer

The user cannot export data.

Answer

The user cannot save searches.

Question 12

When configuring 'LDAP Strategy', what is the purpose of the 'User Base DN'?

Accepted Answer

To define the root search path for users in LDAP.. The 'User Base DN' in an LDAP strategy specifies the distinguished name (DN) of the subtree in the LDAP directory where Splunk should search for user accounts. It acts as the root search path so Splunk knows where to begin looking when binding and authenticating users. Without a correct User Base DN, Splunk cannot locate user entries and authentication fails.

Answer

To define the authentication port.

Answer

To define the administrator's password.

Answer

To specify the LDAP server IP address.

Question 13

Which TWO settings are commonly required when configuring an LDAP strategy?

Accepted Answer

LDAP Group mapping filter. Option D (LDAP Group mapping filter) is correct because an LDAP strategy must define how directory groups are matched and mapped to Splunk roles, typically via a group base DN and a group search filter such as (objectClass=group) or (memberOf=...), so that group membership drives role assignment. Option E (User Base DN) is correct because the strategy needs the distinguished name under which user entries reside (for example, ou=People,dc=example,dc=com) so Splunk can bind and search for authenticating users. Option A is wrong because the local Splunk indexer password is unrelated to directory authentication and is not part of an LDAP strategy. Option B is wrong because browser cache TTL is a web/client-side setting, not an LDAP authentication parameter. Option C is wrong because the LDAP server's disk space is an infrastructure concern, not a configurable field in the LDAP strategy.

Answer

The local Splunk indexer password.

Answer

Browser cache TTL.

Answer

The LDAP server's disk space.

Question 14

Which THREE capabilities are typically assigned to a 'Power User'?

Accepted Answer

rtsearch. In Splunk, the Power User role is a predefined role that inherits from the User role and adds capabilities for creating and sharing searches and knowledge objects. Option B (rtsearch) is correct because Power Users can run real-time searches, a capability not granted to the basic User role. Option C (edit_saved_searches) is correct because Power Users can create, edit, and manage their own saved searches. Option E (edit_shared_objects) is correct because Power Users can create and edit shared knowledge objects such as saved searches, reports, and dashboards that are shared within their apps. Option A (admin_all_objects) is not assigned to Power Users; it is reserved for administrators (e.g., the admin role) and grants full control over all objects. Option D (edit_tcp) is also not assigned to Power Users; it is an administrative capability for configuring TCP inputs and belongs to roles like admin.

Answer

admin_all_objects

Answer

edit_tcp

Question 15

Which TWO of the following are true regarding Role Inheritance?

Accepted Answer

Capabilities are inherited from the parent roles.. Option A is correct because in role inheritance, a child role automatically receives (inherits) the capabilities granted to its parent role(s), so it holds the parent's permissions in addition to any of its own. Option E is correct because a role may inherit from more than one parent role, allowing capabilities to be combined from multiple sources into a single child role. Option B is incorrect because inheritance is a general role feature, not something restricted to the 'admin' role. Option C is incorrect because inheritance is additive: the child role retains its own unique capabilities rather than losing them. Option D is incorrect because role inheritance is an internal authorization mechanism and does not require an LDAP server.

Answer

Inheritance is only supported for the 'admin' role.

Answer

Inheritance causes the child role to lose its own unique capabilities.

Answer

Role inheritance requires an LDAP server.