Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

Splunk SPLK-3001 Exam - Topic 1 Question 73 Discussion

Posted by Chaya on Aug 05, 2023 at 05:42 AM

Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events.

How would the admin restrict these users from being able to change the status of Resolved notable events to Closed?

Suggested Answer: A

Get Premium SPLK-3001 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test
26 comments · newest first
LA
Lai 11 months ago
I’m not sure about that, seems a bit tricky.
CH
Cherri 11 months ago
Totally agree with B!
GE
Gerald 11 months ago
Wait, can they really change Resolved to Closed?
AR
Armanda 11 months ago
I think D makes more sense.
TA
Tatum 12 months ago
B is the way to go!
MA
Malika 12 months ago
I’m leaning towards A, but I recall that giving permissions might not be the best way to restrict actions. I need to think more about the status transitions.
TY
Tyisha 12 months ago
I’m a bit confused about the difference between the statuses. I feel like C could be relevant, but I’m not clear on how it applies to the Closed status.
DA
Dannie 1 year ago
I remember a similar question about user permissions, and it seems like D could also be a valid option since it involves removing capabilities.
HA
Han 1 year ago
I think the answer might be B, but I'm not entirely sure if removing the ess_user from the status transitions for Resolved is the right approach.
SH
Shasta 1 year ago
Yeah, I'm pretty confident those are the right two answers. The team is empowered to make decisions and organize themselves.
DE
Dean 1 year ago
I'm pretty sure IV dextrose provides 3.4 kcal/g, so I'll go with option D.
GU
Gussie 1 year ago
Option C looks promising. By removing the ess_user from the status transitions for the Closed status, they won't be able to change the status of Resolved notable events.
SH
Shannan 1 year ago
↳ replying to Gussie
Yes, it's all about maintaining control and ensuring that only authorized users have the necessary permissions.
GE
Gerald 1 year ago
↳ replying to Gussie
That makes sense. It's important to restrict certain users from making changes that could impact the system.
CO
Cordell 1 year ago
↳ replying to Gussie
Option C looks promising. By removing the ess_user from the status transitions for the Closed status, they won't be able to change the status of Resolved notable events.
EL
Elizabeth 1 year ago
Haha, if the admin wants to really mess with the ess_users, they should just change the Closed status to 'Classified' and watch them scratch their heads.
JE
Jennie 1 year ago
↳ replying to Elizabeth
C) Haha, that would definitely confuse them! But for a more practical approach, the admin should go with option B.
JO
Jolene 1 year ago
↳ replying to Elizabeth
B) From the Status Configuration window select the Closed status. Remove ess_user from the status transitions for the Resolved status.
BI
Billye 1 year ago
↳ replying to Elizabeth
A) In Enterprise Security, give the ess_user role the Own Notable Events permission.
BE
Bernadine 1 year ago
I'm not sure if Option D is the right choice. Removing the edit_notable_events capability might have unintended consequences.
GE
Gerald 1 year ago
Option B seems the way to go. Removing the ess_user role from the status transitions for the Resolved status will do the trick.
CL
Clement 1 year ago
↳ replying to Gerald
User 2: Agreed, removing ess_user from the status transitions for the Resolved status will prevent them from changing the status to Closed.
MI
Miss 1 year ago
↳ replying to Gerald
User 1: I think option B is the best choice.
KR
Kristal 1 year ago
But wouldn't giving the ess_user role the Own Notable Events permission also help restrict them from closing events?
ER
Erick 2 years ago
I agree with Gerald. That way, ess_user won't be able to change the status of Resolved notable events to Closed.
GE
Gerald 2 years ago
I think the admin should remove ess_user from the status transitions for the Closed status.
0/2000 characters

Save Cancel