A small company with 20 users wants SSO for Splunk but does not have an existing identity provider. They want to minimize the number of new components to deploy and manage. Which option should the Splunk consultant recommend?

Use a cloud-based identity provider like Okta or Azure AD

Deploy a new SAML identity provider such as Shibboleth

Use local Splunk authentication with a shared service account

Use LDAP authentication against the local Active Directory

A user reports they cannot log in to Splunk via SAML. Which of the following is a common first troubleshooting step?

Restart the Splunk enterprise server

Disable all other authentication methods

Check the Splunk logs for SAML-related errors

A Splunk administrator is troubleshooting a SAML SSO issue. Users can authenticate, but the 'admin' role is not being assigned to the correct users. The identity provider is sending a 'groups' attribute with the value 'splunk-admins'. The Splunk role mapping is configured to map 'splunk-admins' to 'admin'. What should the administrator check next?

Confirm that the users' browsers are not blocking pop-ups

Verify that the 'groups' attribute is actually present in the SAML assertion

Ensure the Splunk license is valid for SAML role mapping

Check if the Splunk search head is indexing the SAML logs

A Splunk administrator needs to provide SSO for a set of internal tools, including Splunk. The company already runs a Shibboleth identity provider for other applications. Which approach should the administrator take to enable SSO for Splunk?

Enable Splunk's built-in SSO feature that works with any identity provider

Deploy a new AD FS server specifically for Splunk

Use LDAP authentication against the Shibboleth user store

Configure Splunk to use the existing Shibboleth IdP via SAML

In Splunk, which of the following is a required step when configuring SAML authentication?

Importing the identity provider's metadata into Splunk

Installing a third-party plugin on the Splunk server

Enabling the SAML app from Splunkbase

Creating a local user for every SAML user

SplunkCore Certified Consultant

Domain 3Objective 3

List SAML and SSO Options CORE-CERTIFIED-CONSULTANT Practice Questions (Page 2)

Part of the Access and Roles domain, which accounts for 8% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

5concepts

8%of the exam

Questions 6–10

6application · medium
A small company with 20 users wants SSO for Splunk but does not have an existing identity provider. They want to minimize the number of new components to deploy and manage. Which option should the Splunk consultant recommend?
Select an answer first
7foundation · easy
A user reports they cannot log in to Splunk via SAML. Which of the following is a common first troubleshooting step?
Select an answer first
8expert · medium
A Splunk administrator is troubleshooting a SAML SSO issue. Users can authenticate, but the 'admin' role is not being assigned to the correct users. The identity provider is sending a 'groups' attribute with the value 'splunk-admins'. The Splunk role mapping is configured to map 'splunk-admins' to 'admin'. What should the administrator check next?
Select an answer first
9application · medium
A Splunk administrator needs to provide SSO for a set of internal tools, including Splunk. The company already runs a Shibboleth identity provider for other applications. Which approach should the administrator take to enable SSO for Splunk?
Select an answer first
10foundation · easy
In Splunk, which of the following is a required step when configuring SAML authentication?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.