Splunk Exam SPLK-3001 Topic 1 Question 80 Discussion

Actual exam question for Splunk's SPLK-3001 exam

Question #: 80
Topic #: 1

Following the Installation of ES, an admin configured Leers with the ss_uso r role the ability to close notable events. How would the admin restrict these users from being able to change the status of Resolved notable events to closed?

AFrom the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the closed status.

BFrom the Status Configuration windows select the closed status. Remove ess_use r from the status transitions for the Resolved status.

CIn Enterprise Security, give the ess_user role the own Notable Events permission.

DFrom Splunk Access Controls, select the ess_user role and remove the edit_notabie_events capability.

Show Suggested Answer

Suggested Answer: C

by Sarah at Jan 24, 2024, 06:30 PM

Limited Time Offer

25%

Off

Get Premium SPLK-3001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Marsha

8 hours ago

D) is an interesting option, but it would remove the ess_user role's ability to edit any notable events, not just the Resolved ones.

upvoted 0 times

...

Glenn

3 days ago

I'm not sure, but I think option D could also work. Removing the edit_notable_events capability from the ess_user role would limit their ability to close notable events.

upvoted 0 times

...

Lauran

4 days ago

B) is not the right answer, as it would remove the ess_user role from the status transitions for the Resolved status, not the Closed status.

upvoted 0 times

...

Salome

5 days ago

I agree with Ceola. That makes sense. It's important to restrict access to prevent unauthorized changes.

upvoted 0 times

...

Aileen

9 days ago

A) seems like the correct answer, as it restricts the ess_user role from being able to change the status of Resolved notable events to closed.

upvoted 0 times

...

Ceola

12 days ago

I think the answer is A. By removing ess_user from the status transitions for the closed status, they won't be able to change the status of Resolved notable events to closed.

upvoted 0 times

...