MENU
A customer has implemented their own Role Based Access Control (RBAC) model to attempt to give the Security team different data access than the Operations team by creating two new Splunk roles -- security and operations. In the srchIndexesAllowed setting of authorize.conf, they specified the network index
under the security role and the operations index under the operations role. The new roles are set up to inherit the default user role.
If a new user is created and assigned to the operations role only, which indexes will the user have access to search?
Suggested Answer: A
Get Premium SPLK-3003 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
12 comments · newest first
NO
Noble
11 months ago
I thought they might get access to more indexes. Surprised by this!
GL
Glendora
11 months ago
Nope, just operations. The other indexes are restricted.
RO
Roslyn
12 months ago
Wait, what about the default role? Does it give access to anything?
MI
Mindy
12 months ago
Totally agree, it's just the operations index!
WH
Whitney
12 months ago
The user will only have access to the operations index.
CE
Celestina
1 year ago
If the operations role is set up correctly, the user should only see the operations index. I don't think they would get access to the network index.
AL
Alishia
1 year ago
I remember practicing a similar question where roles inherited permissions, but I can't recall if the default role grants access to other indexes.
JE
Jennie
1 year ago
I think the user assigned to the operations role will only have access to the operations index, but I'm not entirely sure about the default role's permissions.
RI
Ricki
1 year ago
I'm a bit confused. Does the default user role allow access to _internal and _audit indexes for users in the operations role? I need to double-check that.
RO
Rory
1 year ago
Okay, I've got this. The key prerequisites are the Log Analytics workspace and the Azure Automation account. Those will provide the necessary infrastructure for Update Management to work. The other options seem like they might be related, but not directly required for this specific setup.
AB
Abraham
1 year ago
Okay, let's see. Optimizing queries to reduce the scope of each search makes sense to me. And a data retention plan to archive or purge cases regularly is a good way to manage the growing volume. I'm pretty confident those are the right two choices.
AS
Ashlyn
1 year ago
Okay, I think I've got this. The key is to identify the file and validate whether it's malicious, so I'd go with option B to use FMC file analysis.