Define Roles and Articulate How Roles Are Used to Secure Data CORE-CERTIFIED-CONSULTANT Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of capabilities in Splunk roles?

   • AThey grant permissions to perform specific actions and access features
   • BThey define which indexes a user can search
   • CThey specify which users belong to a role
   • DThey determine the password policy for users
   Reveal Solution Discussion Select an answer first
2. 7application · easy

   A user is assigned the 'analyst' role and the 'contractor' role. The 'analyst' role has a search filter allowing index=internal. The 'contractor' role has a search filter allowing index=public. What is the user's effective search access?

   • ANo indexes, because the roles conflict.
   • BOnly index=internal, because the analyst role is more privileged.
   • COnly index=public, because the contractor role is more restrictive.
   • DBoth index=internal and index=public.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Splunk environment has a base role 'analyst' that includes the 'search' capability and a search filter restricting access to index=web. A new role 'senior_analyst' is created that inherits from 'analyst'. The senior analyst team needs to also search index=finance. What should be configured to grant this access?

   • AAdd a search filter to 'senior_analyst' that allows index=finance, and ensure the inherited filter from 'analyst' remains.
   • BModify the 'analyst' role's search filter to allow index=finance, so all analysts can access it.
   • CAssign the 'analyst' role to senior analyst users and also assign a new role with finance access.
   • DCreate a new search filter in 'senior_analyst' that denies index=web and allows index=finance.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A user is assigned two roles: 'helpdesk' and 'security_analyst'. The 'helpdesk' role has a search filter that restricts access to index=helpdesk. The 'security_analyst' role has a search filter that allows index=security. What indexes can the user search?

   • ANo indexes, because conflicting filters cancel each other out.
   • BOnly index=security, because the less restrictive filter takes precedence.
   • CBoth index=helpdesk and index=security.
   • DOnly index=helpdesk, because the more restrictive filter takes precedence.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following can be restricted by a search filter in a role?

   • AThe ability to create dashboards
   • BThe number of users in the role
   • CAccess to a specific sourcetype
   • DThe retention period of events
   Reveal Solution Discussion Select an answer first