A user is assigned the 'viewer' role and the 'editor' role. The 'viewer' role has a search filter allowing index=public. The 'editor' role has a search filter allowing index=internal. What is the user's effective search access?

Both index=public and index=internal.

Only index=internal, because the editor role is more privileged.

No indexes, because the roles conflict.

Only index=public, because the viewer role is more restrictive.

How can roles be used to secure sensitive data in Splunk?

By deleting sensitive events after a certain period

By encrypting the data at rest in the index

By preventing users from logging in from certain IP addresses

By restricting access to sensitive indexes, sources, and fields through search filters

How do search filters in a role affect a user's data access?

They define the user's default time range for searches

They set the maximum number of concurrent searches a user can run

They determine which apps the user can install

They limit which indexes, sources, or sourcetypes the user can search

In Splunk, which of the following best describes what a role is?

A set of indexes that a user is allowed to search

A configuration file that stores user passwords and authentication tokens

A group of users who share the same password and login credentials

A collection of capabilities, search filters, and assigned users that define what a user can see and do

SplunkCore Certified Consultant

Domain 3Objective 4

Define Roles and Articulate How Roles Are Used to Secure Data CORE-CERTIFIED-CONSULTANT Practice Questions (Page 1)

Part of the Access and Roles domain, which accounts for 8% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

6concepts

8%of the exam

Questions 1–5

1application · easy
A user is assigned the 'viewer' role and the 'editor' role. The 'viewer' role has a search filter allowing index=public. The 'editor' role has a search filter allowing index=internal. What is the user's effective search access?
Select an answer first
2foundation · easy
How can roles be used to secure sensitive data in Splunk?
Select an answer first
3foundation · easy
How do search filters in a role affect a user's data access?
Select an answer first
4application · medium
A Splunk admin wants to allow a group of power users to create and edit saved searches, but not to manage users or change system settings. Which capability should be added to the role assigned to these users?
Select an answer first
5foundation · easy
In Splunk, which of the following best describes what a role is?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.