Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Splunk SPLK-3001 Exam - Topic 1 Question 73 Discussion

Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events.How would the admin restrict these users from being able to change the status of Resolved notable events to Closed?
A) In Enterprise Security, give the ess_user role the Own Notable Events permission.
B) From the Status Configuration window select the Closed status. Remove ess_user from the status transitions for the Resolved status.
C) From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the Closed status.
D) From Splunk Access Controls, select the ess_user role and remove the edit_notable_events capability.

Splunk SPLK-3001 Exam - Topic 1 Question 73 Discussion

Actual exam question for Splunk's SPLK-3001 exam
Question #: 73
Topic #: 1
[All SPLK-3001 Questions]

Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events.

How would the admin restrict these users from being able to change the status of Resolved notable events to Closed?

Show Suggested Answer Hide Answer
Suggested Answer: A

by Chaya at Aug 05, 2023, 05:42 AM

Limited Time Offer

25%

Off

Get Premium SPLK-3001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Lai
8 months ago
I’m not sure about that, seems a bit tricky.
upvoted 0 times
...
Cherri
8 months ago
Totally agree with B!
upvoted 0 times
...
Gerald
8 months ago
Wait, can they really change Resolved to Closed?
upvoted 0 times
...
Armanda
8 months ago
I think D makes more sense.
upvoted 0 times
...
Tatum
9 months ago
B is the way to go!
upvoted 0 times
...
Malika
9 months ago
I’m leaning towards A, but I recall that giving permissions might not be the best way to restrict actions. I need to think more about the status transitions.
upvoted 0 times
...
Tyisha
9 months ago
I’m a bit confused about the difference between the statuses. I feel like C could be relevant, but I’m not clear on how it applies to the Closed status.
upvoted 0 times
...
Dannie
9 months ago
I remember a similar question about user permissions, and it seems like D could also be a valid option since it involves removing capabilities.
upvoted 0 times
...
Han
9 months ago
I think the answer might be B, but I'm not entirely sure if removing the ess_user from the status transitions for Resolved is the right approach.
upvoted 0 times
...
Shasta
9 months ago
Yeah, I'm pretty confident those are the right two answers. The team is empowered to make decisions and organize themselves.
upvoted 0 times
...
Dean
10 months ago
I'm pretty sure IV dextrose provides 3.4 kcal/g, so I'll go with option D.
upvoted 0 times
...
Gussie
1 year ago
Option C looks promising. By removing the ess_user from the status transitions for the Closed status, they won't be able to change the status of Resolved notable events.
upvoted 0 times
Shannan
1 year ago
Yes, it's all about maintaining control and ensuring that only authorized users have the necessary permissions.
upvoted 0 times
...
Gerald
1 year ago
That makes sense. It's important to restrict certain users from making changes that could impact the system.
upvoted 0 times
...
Cordell
1 year ago
Option C looks promising. By removing the ess_user from the status transitions for the Closed status, they won't be able to change the status of Resolved notable events.
upvoted 0 times
...
...
Elizabeth
1 year ago
Haha, if the admin wants to really mess with the ess_users, they should just change the Closed status to 'Classified' and watch them scratch their heads.
upvoted 0 times
Jennie
1 year ago
C) Haha, that would definitely confuse them! But for a more practical approach, the admin should go with option B.
upvoted 0 times
...
Jolene
1 year ago
B) From the Status Configuration window select the Closed status. Remove ess_user from the status transitions for the Resolved status.
upvoted 0 times
...
Billye
1 year ago
A) In Enterprise Security, give the ess_user role the Own Notable Events permission.
upvoted 0 times
...
...
Bernadine
1 year ago
I'm not sure if Option D is the right choice. Removing the edit_notable_events capability might have unintended consequences.
upvoted 0 times
...
Gerald
1 year ago
Option B seems the way to go. Removing the ess_user role from the status transitions for the Resolved status will do the trick.
upvoted 0 times
Clement
1 year ago
User 2: Agreed, removing ess_user from the status transitions for the Resolved status will prevent them from changing the status to Closed.
upvoted 0 times
...
Miss
1 year ago
User 1: I think option B is the best choice.
upvoted 0 times
...
...
Kristal
1 year ago
But wouldn't giving the ess_user role the Own Notable Events permission also help restrict them from closing events?
upvoted 0 times
...
Erick
1 year ago
I agree with Gerald. That way, ess_user won't be able to change the status of Resolved notable events to Closed.
upvoted 0 times
...
Gerald
1 year ago
I think the admin should remove ess_user from the status transitions for the Closed status.
upvoted 0 times
...

Save Cancel