List SAML and SSO Options CORE-CERTIFIED-CONSULTANT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a typical step in configuring Splunk as a service provider in a SAML setup?

   • ADisabling all other authentication methods in Splunk
   • BCreating a SAML assertion manually for each user
   • CProviding the Splunk ACS URL and entity ID to the identity provider
   • DConfiguring Splunk to act as the identity provider
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A company has two Splunk deployments: one for internal employees and one for external partners. The internal deployment uses SAML with the corporate IdP. The external deployment needs SSO but the partners do not have accounts in the corporate IdP. What should the Splunk consultant recommend for the external deployment?

   • AUse the same corporate IdP and create partner accounts in it
   • BConfigure a separate SAML IdP for partners, such as a cloud-based IdP
   • CUse local Splunk authentication for the external deployment
   • DReuse the internal SAML configuration but disable role mapping
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   Users report that they can log into Splunk via SAML, but they are not seeing the expected dashboards and data. The administrator confirms the users are in the correct groups in the identity provider. What is the most likely cause of this issue?

   • AThe SAML attribute containing group information is not being sent or is not mapped to Splunk roles
   • BThe identity provider is rejecting the Splunk service provider certificate
   • CThe Splunk search head is not indexing the dashboards
   • DThe users' SAML session has expired before they view the dashboards
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Splunk consultant is configuring SAML authentication. The identity provider requires the service provider's metadata to complete the trust configuration. Which Splunk endpoint should the consultant provide to the IdP administrator?

   • AThe Splunk management console URL
   • BThe Splunk Web login page URL
   • CThe Splunk SAML metadata endpoint
   • DThe Splunk REST API endpoint for authentication
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A Splunk administrator is reviewing authentication options for a small team of 10 users who all have existing Active Directory accounts. The team wants to use their AD credentials to access Splunk Web. The company does not currently have any SAML identity provider deployed. Which SSO option requires the least additional infrastructure to implement?

   • ASAML with a third-party cloud identity provider
   • BLDAP authentication against Active Directory
   • CSAML with Active Directory Federation Services (AD FS)
   • DLocal Splunk authentication with manually synced passwords
   Reveal Solution Discussion Select an answer first