Splunk SPLK-3003 Exam - Topic 3 Question 29 Discussion

Actual exam question for Splunk's SPLK-3003 exam

Question #: 29
Topic #: 3

A customer has implemented their own Role Based Access Control (RBAC) model to attempt to give the Security team different data access than the Operations team by creating two new Splunk roles -- security and operations. In the srchIndexesAllowed setting of authorize.conf, they specified the network index

under the security role and the operations index under the operations role. The new roles are set up to inherit the default user role.

If a new user is created and assigned to the operations role only, which indexes will the user have access to search?

Aoperations, network, _internal, _audit

Boperations

CNo Indexes

Doperations, network

Show Suggested Answer

Suggested Answer: A

by Raylene at May 05, 2022, 12:33 PM

Limited Time Offer

25%

Off

Get Premium SPLK-3003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Noble

4 months ago

I thought they might get access to more indexes. Surprised by this!

upvoted 0 times

...

Glendora

4 months ago

Nope, just operations. The other indexes are restricted.

upvoted 0 times

...

Roslyn

4 months ago

Wait, what about the default role? Does it give access to anything?

upvoted 0 times

...

Mindy

4 months ago

Totally agree, it's just the operations index!

upvoted 0 times

...

Whitney

4 months ago

The user will only have access to the operations index.

upvoted 0 times

...

Celestina

5 months ago

If the operations role is set up correctly, the user should only see the operations index. I don't think they would get access to the network index.

upvoted 0 times

...

Alishia

5 months ago

I remember practicing a similar question where roles inherited permissions, but I can't recall if the default role grants access to other indexes.

upvoted 0 times

...

Jennie

5 months ago

I think the user assigned to the operations role will only have access to the operations index, but I'm not entirely sure about the default role's permissions.

upvoted 0 times

...

Ricki

5 months ago

I'm a bit confused. Does the default user role allow access to _internal and _audit indexes for users in the operations role? I need to double-check that.

upvoted 0 times

...

Rory

5 months ago

Okay, I've got this. The key prerequisites are the Log Analytics workspace and the Azure Automation account. Those will provide the necessary infrastructure for Update Management to work. The other options seem like they might be related, but not directly required for this specific setup.

upvoted 0 times

...

Abraham

5 months ago

Okay, let's see. Optimizing queries to reduce the scope of each search makes sense to me. And a data retention plan to archive or purge cases regularly is a good way to manage the growing volume. I'm pretty confident those are the right two choices.

upvoted 0 times

...

Ashlyn

5 months ago

Okay, I think I've got this. The key is to identify the file and validate whether it's malicious, so I'd go with option B to use FMC file analysis.

upvoted 0 times

...