CCNA User And Authentication Management Questions

Multi-Selectmedium

Which THREE of the following are true about the 'can_delete' capability?

Select 3 answers

A.It requires the user to be an LDAP admin.

B.It allows a user to delete the Splunk license.

C.It allows the use of the 'delete' command.

D.It does not actually reclaim disk space.

E.It is assigned to the 'admin' role by default.

AnswersC, D, E

This command is required to remove data from indexes.

Why this answer

The 'can_delete' capability is a powerful tool requiring specific assignment and usage restrictions to prevent accidental data loss.

Practice this question →

MCQhard

A user inherits roles 'RoleA' and 'RoleB'. 'RoleA' has 'srchIndexesAllowed' set to 'index1' and 'RoleB' has it set to 'index2'. What indexes can the user access?

A.Both index1 and index2.

B.Only index1.

C.Only index2.

D.No indexes.

AnswerA

Splunk additive permission logic merges index access across all inherited roles.

Why this answer

When roles are combined, the cumulative set of allowed indexes is the union of all indexes allowed by all assigned roles.

Practice this question →

MCQmedium

Which configuration file is used to map LDAP groups to Splunk roles?

A.ldap.conf

B.web.conf

C.authorize.conf

D.authentication.conf

AnswerD

This file handles the mapping between external LDAP groups and Splunk roles.

Why this answer

Authentication.conf contains the role mapping logic for LDAP strategies.

Practice this question →

MCQhard

If you want to use SAML authentication, which component must be configured as the 'Service Provider'?

A.The browser.

B.The Splunk Instance.

C.The Identity Provider (IdP).

D.The LDAP Server.

AnswerB

Splunk acts as the Service Provider in the SAML exchange.

Why this answer

The Splunk instance itself acts as the Service Provider (SP) in the SAML handshake.

Practice this question →

MCQmedium

An administrator needs to ensure that users from an LDAP group 'Splunk_Power_Users' are automatically assigned the 'power' role in Splunk. Where is this mapping configured?

A.In authorize.conf under the [role_power] stanza.

B.In user-prefs.conf.

C.In authentication.conf within the [roleMap_LDAP_name] stanza.

D.In distsearch.conf.

AnswerC

The role mapping between LDAP groups and Splunk roles is defined in authentication.conf.

Why this answer

LDAP group mapping is configured in the Authentication Method settings under 'Role mapping'.

Practice this question →

Multi-Selectmedium

Which TWO of the following are true regarding Role Inheritance?

Select 2 answers

A.Capabilities are inherited from the parent roles.

B.Inheritance is only supported for the 'admin' role.

C.Inheritance causes the child role to lose its own unique capabilities.

D.Role inheritance requires an LDAP server.

E.A role can inherit from multiple other roles.

AnswersA, E

This is the core purpose of role inheritance.

Why this answer

Inheritance allows roles to acquire the capabilities and permissions of other roles in a hierarchical structure.

Practice this question →

MCQeasy

What is the effect of setting 'allow_debug' to false in a role?

A.The user cannot log in.

B.The user cannot export data.

C.The user cannot save searches.

D.The user cannot use the debug tools in the search bar.

AnswerD

This is the direct effect of the capability.

Why this answer

The 'allow_debug' capability enables the use of the debug tools in the search bar. Disabling it restricts this functionality.

Practice this question →

MCQhard

You are troubleshooting an issue where a user cannot view a specific dashboard. The user has the 'user' role. What is the most likely cause?

A.The user does not have the 'admin' role.

B.The index used in the search is not allowed.

C.The user has too many roles assigned.

D.The object permissions for the dashboard are not set to 'Global' or the user's role.

AnswerD

Dashboards require explicit read permissions for the user's role.

Why this answer

The user likely lacks read access to the 'App' or 'Dashboard' object in the context of the app's permissions.

Practice this question →

MCQeasy

Which capability is required for a user to see the 'Settings' menu in Splunk Web?

A.edit_settings

B.user

C.can_view_settings

D.admin

AnswerA

This capability is required for administrative UI access.

Why this answer

The 'edit_settings' capability is required to access and modify settings in Splunk Web.

Practice this question →

Multi-Selectmedium

Which TWO items are contained within an 'authorize.conf' role stanza?

Select 2 answers

A.User password hash

B.UI theme setting

C.srchIndexesAllowed

D.capabilities

E.LDAP Group mapping

AnswersC, D

Defines which indexes are searchable.

Why this answer

Authorize.conf stanzas define the specific index access and capability set for a role.

Practice this question →

Multi-Selecteasy

Which TWO of the following describe the 'admin' role?

Select 2 answers

A.It is restricted to searching only the 'main' index.

B.It is built-in and cannot be deleted.

C.It is only available on Enterprise licenses.

D.It has all capabilities enabled by default.

E.It must be assigned to an LDAP group.

AnswersB, D

The default 'admin' role is protected.

Why this answer

The admin role is the master role that possesses all capabilities and full access.

Practice this question →

Multi-Selecthard

Which THREE capabilities are typically assigned to a 'Power User'?

Select 3 answers

A.admin_all_objects

B.rtsearch

C.edit_saved_searches

D.edit_tcp

E.edit_shared_objects

AnswersB, C, E

Allowed for power users to run real-time searches.

Why this answer

Power users typically have abilities to edit shared objects, perform real-time searches, and manage saved searches.

Practice this question →

MCQhard

An administrator wants to ensure that a specific role cannot search over a time range greater than 24 hours. Where is this limit configured?

A.limits.conf

B.authorize.conf

C.server.conf

D.authentication.conf

AnswerB

'srchTimeWin' is a property of a role defined in authorize.conf.

Why this answer

The 'srchTimeWin' attribute in the role definition within authorize.conf restricts the maximum search time window.

Practice this question →

MCQmedium

How can an administrator monitor failed login attempts for a specific user?

A.Search the 'audit' index for sourcetype 'splunkd_access'.

B.Review the 'user-prefs.conf' file.

C.Check the 'internal' index for 'User management' events.

D.Use the 'splunk login-history' CLI command.

AnswerA

Failed logins are logged in the access logs.

Why this answer

Failed login attempts are recorded in the 'audit' index under the 'splunkd_access.log' source.

Practice this question →

Multi-Selecteasy

Which TWO items are managed within the 'Access Controls' menu in Splunk Web?

Select 2 answers

A.Users

B.Deployment server status

C.Roles

D.Index volume settings

E.Saved search scheduling

AnswersA, C

User accounts are managed here.

Why this answer

Access controls is the primary location for managing users and roles.

Practice this question →

Multi-Selecthard

Which THREE parameters must be exchanged between Splunk and an Identity Provider for SAML to work?

Select 3 answers

A.SP Metadata XML

B.LDAP Bind Password

C.SSL Certificate

D.The Splunk license key.

E.Entity ID

AnswersA, C, E

Contains configuration data for the handshake.

Why this answer

SAML integration requires the exchange of metadata, typically including entity IDs and certificates.

Practice this question →

Multi-Selecthard

Which THREE of these represent common issues when troubleshooting LDAP authentication?

Select 3 answers

A.Incorrect User Search Filter

B.Invalid Bind DN credentials

C.Wrong LDAP server port

D.The user's local disk is full.

E.Browser cookie expiration

AnswersA, B, C

Prevents Splunk from finding the user object.

Why this answer

Incorrect bind credentials, incorrect search filters, and mapping issues are the most frequent causes of LDAP failure.

Practice this question →

Multi-Selectmedium

Which TWO of the following are valid ways to authenticate users in Splunk?

Select 2 answers

A.Internal Splunk authentication

B.RADIUS

C.DNS-based auth

D.SQL database lookup

E.LDAP

AnswersA, E

This is the default authentication mechanism.

Why this answer

Splunk supports internal database authentication and various external providers like LDAP and SAML.

Practice this question →

MCQmedium

Which user account is created by default and intended for administrative use, which should have its default password changed immediately?

A.root

B.admin

C.manager

D.splunk-system

AnswerB

'admin' is the default superuser account.

Why this answer

The 'admin' user is the default superuser account.

Practice this question →

MCQhard

If a user is assigned two roles, 'RoleA' and 'RoleB', and 'RoleA' has 'rtsearch' enabled while 'RoleB' has 'rtsearch' disabled, what is the user's effective capability for real-time searches?

A.The user can only perform real-time searches on index 'main'.

B.The user can perform real-time searches.

C.The user cannot perform real-time searches.

D.The user is prompted to choose which role to act as.

AnswerB

Because 'RoleA' has the capability, the user inherits it.

Why this answer

Capabilities in Splunk are additive; if any assigned role has the capability, the user possesses that capability.

Practice this question →

MCQmedium

What is the purpose of the 'srchFilter' attribute in a role definition?

A.To restrict which indexes a user can see.

B.To automatically prepend a filter to all searches performed by the user.

C.To block specific users from the system.

D.To limit the number of results returned.

AnswerB

'srchFilter' enforces a search-time filter for specific roles.

Why this answer

The 'srchFilter' adds a hidden search filter to all searches run by the user to ensure data isolation.

Practice this question →

MCQmedium

What happens to a local user account if the underlying LDAP group they belong to is deleted?

A.The user can still log in using their previous password.

B.The user account is automatically deleted from Splunk.

C.The user will be unable to authenticate via LDAP.

D.The user is automatically promoted to the 'admin' role.

AnswerC

Without the LDAP group, the authentication provider cannot verify the user's credentials.

Why this answer

The local Splunk user object remains, but if authentication is tied exclusively to the LDAP group, the user will be unable to log in.

Practice this question →

Multi-Selectmedium

Which TWO settings are commonly required when configuring an LDAP strategy?

Select 2 answers

A.The local Splunk indexer password.

B.Browser cache TTL.

C.The LDAP server's disk space.

D.LDAP Group mapping filter

E.User Base DN

AnswersD, E

Required to map directory groups to roles.

Why this answer

LDAP strategies require a base DN for users and a user-to-DN mapping format.

Practice this question →

MCQhard

You are configuring SAML authentication and need to map the 'email' attribute from the Identity Provider to the Splunk 'realName' field. Where do you configure this?

A.server.conf

B.SAML Configuration in Splunk Web.

C.authorize.conf

D.web.conf

AnswerB

The UI provides fields for mapping IdP attributes to Splunk user attributes.

Why this answer

The SAML attribute mapping is defined in the SAML configuration within the Splunk Web UI under Access Controls > Authentication Method.

Practice this question →

MCQeasy

What is the default role assigned to a new user account if no other role is specified?

A.admin

B.power

C.user

D.can_delete

AnswerC

'user' is the standard default role.

Why this answer

The 'user' role is the default role assigned to new accounts.

Practice this question →

MCQeasy

What happens to a user's session if their role is modified while they are logged in?

A.The changes are applied immediately to their current session.

B.The user's session is terminated after 5 minutes.

C.The user must log out and back in for changes to take effect.

D.The user is forced to log out immediately.

AnswerC

Session-based caching requires a re-login to pick up new permissions.

Why this answer

Changes to a user's role permissions take effect only upon the next login (or session refresh).

Practice this question →

MCQmedium

You need to restrict a specific user from accessing the 'internal' index even though their assigned role has access to all indexes. How do you implement this restriction?

A.Use a 'blacklist' in authorize.conf for the specific user.

B.Modify the user's account and set the indexes access to 'none'.

C.Set the 'allow_index_access' capability to false for the user.

D.Create a new role with 'srchIndexesAllowed' excluding 'internal' and assign this role to the user.

AnswerD

Roles allow for granular control of index access via the 'srchIndexesAllowed' attribute.

Why this answer

You must create a new role that explicitly excludes the 'internal' index in the 'srchIndexesAllowed' field and assign it to the user.

Practice this question →

MCQmedium

You need to enable multi-factor authentication (MFA) for your Splunk instance. Where is this usually integrated?

A.In user-prefs.conf

B.Inside authorize.conf

C.Via SAML integration with an Identity Provider.

D.By modifying the 'admin' user account in the CLI.

AnswerC

SAML is the standard way to delegate MFA to an enterprise IdP.

Why this answer

MFA is typically integrated through the SAML Identity Provider, or via Duo Security integration if using the specific Splunk plugin.

Practice this question →

MCQeasy

Which menu path in Splunk Web is used to manage existing user roles?

A.Settings > Access controls > Roles

B.Settings > Authentication method

C.Settings > Server settings

D.Settings > Access controls > Users

AnswerA

This is the correct path for role management.

Why this answer

Settings > Access controls > Roles is the path to manage roles.

Practice this question →

MCQeasy

Which of the following is a 'capability' in Splunk?

A.SAML_Auth

B.Modify User.

C.edit_own_objects

D.View Index.

AnswerC

This is a standard Splunk capability.

Why this answer

'edit_own_objects' is a built-in capability that allows users to modify their own saved searches and dashboards.

Practice this question →

MCQeasy

Which file stores the definitions of roles and their associated capabilities?

A.authorize.conf

B.indexes.conf

C.authentication.conf

D.limits.conf

AnswerA

Roles and capabilities reside in authorize.conf.

Why this answer

authorize.conf is the configuration file that manages roles and capabilities.

Practice this question →

MCQmedium

If you want to prevent a user from using the 'delete' command, which capability must be removed from their assigned role?

A.delete

B.edit_search

C.can_delete_data

D.admin_all_objects

AnswerA

The 'delete' capability is specifically required to use the delete command.

Why this answer

The 'delete' capability is required to run the 'delete' search command.

Practice this question →

MCQhard

When configuring 'LDAP Strategy', what is the purpose of the 'User Base DN'?

A.To define the authentication port.

B.To define the administrator's password.

C.To specify the LDAP server IP address.

D.To define the root search path for users in LDAP.

AnswerD

This sets the directory tree scope for user lookups.

Why this answer

The 'User Base DN' specifies the node in the LDAP directory where Splunk should begin searching for user objects.

Practice this question →