SPLK-1003 User And Authentication Management Practice Test 4 — 15 Questions

Question 1

Which TWO items are contained within an 'authorize.conf' role stanza?

Accepted Answer

srchIndexesAllowed. In an authorize.conf role stanza, srchIndexesAllowed (option C) is correct because it defines the comma-separated list of indexes that users assigned to that role are permitted to search, controlling index-level access. Option D, capabilities, is also correct because a role stanza lists the specific capabilities (such as search, schedule_search, or admin_all_objects) granted to that role, which is the core purpose of role-based access control in Splunk. Option A is incorrect because user password hashes are stored in the authentication backend (e.g., passwd file or external identity provider), not in authorize.conf role stanzas. Option B is incorrect because UI theme settings are user preferences stored in user-prefs.conf or the user's profile, not in role definitions. Option E is incorrect because LDAP group mapping is configured in authentication.conf under the [roleMap_<authType>] stanza, not inside an authorize.conf role stanza.

Answer

User password hash

Answer

UI theme setting

Answer

LDAP Group mapping

Question 2

Which TWO of the following describe the 'admin' role?

Accepted Answer

It is built-in and cannot be deleted.. Option B is correct because the 'admin' role is a built-in role in Splunk, and built-in roles cannot be deleted (though they can be modified or cloned). Option D is correct because the 'admin' role has all capabilities enabled by default, giving it full access to Splunk features and settings. Option A is incorrect because the 'admin' role is not restricted to searching only the 'main' index; it can search all indexes by default. Option C is incorrect because the 'admin' role is available on all Splunk licenses, not only Enterprise. Option E is incorrect because the 'admin' role does not have to be assigned to an LDAP group; it can be assigned to local users or groups as needed.

Answer

It is restricted to searching only the 'main' index.

Answer

It is only available on Enterprise licenses.

Answer

It must be assigned to an LDAP group.

Question 3

Which THREE of these represent common issues when troubleshooting LDAP authentication?

Accepted Answer

Incorrect User Search Filter. Option A (Incorrect User Search Filter) is correct because LDAP authentication typically requires a search filter (e.g., (uid=%s) or (sAMAccountName=%s)) to locate the user's DN before binding; a malformed or wrong filter causes the search to return zero entries and authentication to fail. Option B (Invalid Bind DN credentials) is correct because the service account or bind DN used to connect to the directory must supply valid credentials; an incorrect password or DN results in an LDAP error 49 (Invalid Credentials) and prevents any lookup or bind. Option C (Wrong LDAP server port) is correct because LDAP uses TCP 389 (or 636 for LDAPS), and pointing the client at the wrong port causes connection refused or timeout errors that block authentication entirely. Option D (local disk full) is unrelated to LDAP protocol authentication and would only affect local system operations, not directory binds. Option E (browser cookie expiration) concerns HTTP session state, not LDAP bind/search operations, so it is not an LDAP authentication troubleshooting issue.

Answer

The user's local disk is full.

Answer

Browser cookie expiration

Question 4

A security analyst at your organization must be able to create and schedule saved searches and alerts, but must NOT be able to install apps or manage other users. You are assigning roles in Splunk Enterprise. Which built-in role should you assign to meet these requirements with least privilege?

Accepted Answer

power. The power role is designed for users who need to create and share searches, reports, and alerts but do not require administrative privileges. It includes the schedule_search capability and other search-related capabilities while excluding app installation and user management, making it the correct least-privilege choice for this scenario.

Answer

admin

Answer

can_delete

Answer

user

Question 5

You are configuring LDAP authentication for Splunk Enterprise. You want to ensure that users are authenticated against the LDAP directory and that their group memberships are mapped to Splunk roles. Which two configuration settings must you define in authentication.conf to achieve this? (Choose two.)

Accepted Answer

groupBaseDN. To authenticate users via LDAP and map their group memberships to Splunk roles, you must specify the userBaseDN to locate user accounts and the groupBaseDN to locate groups. These settings enable Splunk to search the directory for users and groups, and then use the roleMap to assign roles based on group membership.

Answer

bindDN

Answer

srvBaseDN

Answer

roleBaseDN

Question 6

A user reports that they can log in to Splunk Web but cannot see the 'Settings' menu or access the 'Users' page. You check their roles and find they have the 'user' role. Which capability must you add to a custom role to allow them to manage users?

Accepted Answer

edit_user. To manage users, a role must include the edit_user capability. This capability grants access to the Users page and allows creating, editing, and deleting user accounts. The list_users capability only allows viewing, while edit_roles and edit_authentication govern other aspects of administration.

Answer

list_users

Answer

edit_authentication

Answer

edit_roles

Question 7

You are configuring SAML authentication for Splunk Enterprise. You need to ensure that when a user authenticates via SAML, their Splunk roles are assigned based on an attribute sent by the Identity Provider (IdP). Which configuration setting in authentication.conf allows you to map an IdP attribute to Splunk roles?

Accepted Answer

roleMap. The roleMap setting in authentication.conf maps values from a specified SAML attribute to Splunk roles. You must also define which SAML attribute contains the role information (using the 'attribute' setting under the SAML stanza). The roleMap then translates those attribute values into Splunk roles, enabling dynamic role assignment.

Answer

roleAttribute

Answer

groupAttribute

Answer

attributeQuery

Question 8

A security team requires that all Splunk users authenticate through your corporate LDAP directory, but they also need a local break-glass account in case LDAP becomes unreachable. You configure LDAP authentication in Splunk Web. Which action ensures the local administrator account can still log in when the LDAP servers are down?

Accepted Answer

Configure LDAP as the authentication scheme and ensure the local administrator account has a password set and is not disabled.. Selecting LDAP as the authentication scheme routes normal logins to the directory, but Splunk retains local accounts that have a password and are enabled. The built-in admin account is local by default, so setting its password and leaving it enabled provides emergency access if LDAP is unreachable. This is the documented method for maintaining a local fallback while using an external authentication scheme.

Answer

Enable the 'Allow local users' option under LDAP settings and map the local administrator to an LDAP group.

Answer

Create a second authentication scheme entry for 'Splunk' and set it as the default, then add LDAP as a secondary scheme.

Answer

Add the local administrator to the 'admin' role and leave the default authentication scheme as 'Splunk'.

Question 9

A Splunk administrator is configuring LDAP authentication and needs to ensure that only users who are members of the 'SplunkAdmins' group in Active Directory can log in. The LDAP strategy has been set up with a User Base DN and a bind account. Which additional setting must be configured to enforce this restriction?

Accepted Answer

Configure a 'User Filter' that includes a membership condition for the 'SplunkAdmins' group.. To restrict LDAP authentication to members of a specific group, you must modify the User Filter to include a group membership condition. This filter is applied during the user search phase of authentication, so only users matching the filter will be found and allowed to log in. Other settings like Group Base DN, role mapping, or Bind DN do not enforce login restrictions based on group membership.

Answer

Set the 'Bind DN' to a user account that is a member of the 'SplunkAdmins' group.

Answer

Set the 'Group Base DN' to the distinguished name of the 'SplunkAdmins' group.

Answer

Enable 'Role Mapping' and map the 'SplunkAdmins' group to the admin role.

Question 10

A new Splunk administrator is reviewing user roles and notices that the 'admin' role has the 'edit_roles' capability. What does this capability allow a user to do?

Accepted Answer

Create, edit, and delete roles, as well as assign capabilities to roles.. The edit_roles capability is specifically designed to manage roles within Splunk, including creating, editing, and deleting roles, and assigning capabilities to them. It does not cover user account management, authentication settings, or license management, which are handled by other distinct capabilities. Understanding these boundaries is essential for proper role-based access control.

Answer

Change license group assignments and manage license usage.

Answer

Edit user account details such as full name, email, and password.

Answer

Modify authentication settings such as LDAP or SAML configuration.

Question 11

You are an admin for a Splunk Enterprise deployment. You need to create a new user account for a colleague who will only need to search data and create reports, but should not have the ability to change any system settings. Which default Splunk role should you assign to this user?

Accepted Answer

user. The 'user' role provides the essential capabilities for searching and creating reports without administrative privileges. It aligns with the principle of least privilege for a user who only needs to search and report, and does not require the additional sharing capabilities of the 'power' role or the system settings access of the 'admin' role.

Answer

power

Answer

can_delete

Answer

admin

Question 12

An administrator needs to allow a group of users to access Splunk Web using their existing Active Directory credentials but wants to avoid storing user passwords in Splunk. Which authentication method should be configured?

Accepted Answer

LDAP authentication. LDAP authentication is the appropriate choice because it integrates directly with Active Directory, allowing users to log in with their AD credentials without Splunk storing passwords. Splunk validates credentials by binding to the LDAP server. While SAML and ProxySSO also avoid storing passwords, they require additional infrastructure (IdP or proxy) and are not as directly aligned with using Active Directory credentials in this scenario.

Answer

Splunk native authentication

Answer

SAML authentication

Answer

ProxySSO authentication

Question 13

A Splunk administrator is troubleshooting why some users are unable to log in after LDAP authentication was configured. The LDAP server is reachable, and the bind account credentials are correct. Which two settings should be verified to ensure that user searches are successful? (Choose two.)

Accepted Answer

User Filter. For LDAP authentication to succeed, Splunk must locate the user's DN in the directory. This depends on the User Base DN, which sets the search scope, and the User Filter, which identifies the user object. If either is incorrect, the user search fails, and authentication cannot proceed. Group Base DN, bind password, and role mapping affect other aspects but not the initial user search.

Answer

Bind DN password

Answer

Role mapping configuration

Answer

Group Base DN

Question 14

A Splunk administrator is troubleshooting an LDAP authentication issue where users are unable to log in. The administrator confirms that the LDAP server is reachable and the bind credentials are correct. Which Splunk log file should the administrator review to find detailed error messages about the LDAP authentication failure?

Accepted Answer

splunkd.log. The splunkd.log file records all authentication-related events, including LDAP bind attempts and failures. It provides detailed error messages that can help identify issues such as incorrect group mappings, invalid user filters, or connection problems. Administrators should search splunkd.log for keywords like 'LDAP' or 'authentication' to pinpoint the cause of the failure.

Answer

web_service.log

Answer

audit.log

Answer

metrics.log

Question 15

A Splunk administrator is configuring SAML authentication for the company's Splunk Enterprise deployment. The Identity Provider (IdP) sends a group attribute named 'memberOf' containing the value 'CN=SplunkPowerUsers,OU=Groups,DC=corp,DC=local'. The administrator needs this group to automatically map to the 'power' role in Splunk. Which configuration file and stanza should the administrator edit to accomplish this?

Accepted Answer

authentication.conf, under the [roleMap_SAML] stanza with the attribute 'power = CN=SplunkPowerUsers,OU=Groups,DC=corp,DC=local'. SAML group-to-role mapping in Splunk Enterprise is configured in authentication.conf within a [roleMap_SAML] stanza, where each entry pairs a Splunk role with one or more IdP group values. This allows automatic role assignment at login based on the IdP's group assertion. The [saml] stanza handles identity provider connection details, while authorize.conf defines role capabilities, not SAML mappings.

Answer

authentication.conf, under the [saml] stanza with the attribute 'roleMap'

Answer

web.conf, under the [settings] stanza with the attribute 'samlRoleMapping'

Answer

authorize.conf, under the [role_power] stanza with the attribute 'samlGroup'