List SAML and SSO Options CORE-CERTIFIED-CONSULTANT Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   A Splunk administrator is configuring SAML role mapping. The identity provider sends a 'role' attribute with values like 'admin' and 'power'. The administrator wants to map 'admin' to the 'admin' role and 'power' to the 'power' role. However, the IdP also sends a 'groups' attribute. What is the best practice for configuring the role mapping?

   • AMap both 'role' and 'groups' attributes to the same Splunk roles
   • BUse the 'role' attribute for role mapping and ignore the 'groups' attribute
   • CCreate a lookup table to combine 'role' and 'groups' into a single role
   • DUse the 'groups' attribute for role mapping and ignore the 'role' attribute
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How does Splunk use SAML attributes to assign roles to users?

   • ASplunk automatically creates a role for each unique SAML attribute
   • BSplunk assigns roles based on the user's email domain
   • CSplunk ignores SAML attributes and uses only local roles
   • DSplunk maps a specific SAML attribute value to a Splunk role using role mapping rules
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In a typical SAML single sign-on flow, which component issues the authentication assertion that is sent to the service provider?

   • AThe user's web browser
   • BThe identity provider
   • CThe service provider
   • DThe certificate authority
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A Splunk consultant is setting up SAML for a customer. The identity provider sends a 'groups' attribute with values like 'engineering' and 'finance'. The customer wants all users with the 'engineering' group to have the 'power' role in Splunk. Which configuration step is required in Splunk?

   • ACreate a Splunk role named 'engineering' and assign it to the 'power' role
   • BSet up a lookup table that converts 'engineering' to 'power' for role assignment
   • CConfigure the identity provider to send the 'power' role directly instead of 'engineering'
   • DCreate a role mapping entry that maps the 'groups' attribute value 'engineering' to the 'power' role
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A user attempts to log into Splunk via SAML and receives a 'SAML response validation failed' error. The administrator has verified that the identity provider is correctly configured and the user's credentials are valid. What is the most likely cause of this error?

   • AThe Splunk search head is not indexing the SAML logs
   • BThe user's browser has cached an old Splunk login page
   • CThe clock on the Splunk server is out of sync with the identity provider
   • DThe user's Splunk role has been deleted
   Reveal Solution Discussion Select an answer first