A company uses SAML SSO for Splunk. The identity provider sends an attribute called 'memberOf' that contains the user's group memberships. The Splunk administrator wants users in the 'splunk-admins' group to receive the 'admin' role in Splunk. What must be configured in Splunk to achieve this?

A scripted authentication module that parses the 'memberOf' attribute

A role mapping that matches the 'memberOf' attribute value to the 'admin' role

A lookup table that translates the 'memberOf' attribute to the 'admin' role

A saved search that assigns the 'admin' role based on the 'memberOf' attribute

A Splunk administrator has configured SAML SSO. Users can authenticate successfully, but all users are receiving the 'user' role regardless of their group memberships in the identity provider. What is the most likely cause?

The Splunk server's clock is out of sync with the identity provider

The users' browsers have disabled cookies

The identity provider is sending the wrong username format

The SAML attribute containing group information is not mapped to any Splunk roles

SplunkCore Certified Consultant

Domain 3Objective 3

List SAML and SSO Options CORE-CERTIFIED-CONSULTANT Practice Questions (Page 6)

Part of the Access and Roles domain, which accounts for 8% of the CORE-CERTIFIED-CONSULTANT exam. Splunk does not publish an official question count, but from its 120-minute exam (~50–80 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

5concepts

8%of the exam

Questions 26–27

26application · medium
A company uses SAML SSO for Splunk. The identity provider sends an attribute called 'memberOf' that contains the user's group memberships. The Splunk administrator wants users in the 'splunk-admins' group to receive the 'admin' role in Splunk. What must be configured in Splunk to achieve this?
Select an answer first
27application · medium
A Splunk administrator has configured SAML SSO. Users can authenticate successfully, but all users are receiving the 'user' role regardless of their group memberships in the identity provider. What is the most likely cause?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CORE-CERTIFIED-CONSULTANT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Splunk. “CORE-CERTIFIED-CONSULTANT” is a trademark of its owner, used for identification only.

List SAML and SSO Options CORE-CERTIFIED-CONSULTANT Practice Questions (Page 6)

Questions 26–27

A company uses SAML SSO for Splunk. The identity provider sends an attribute called 'memberOf' that contains the user's group memberships. The Splunk administrator wants users in the 'splunk-admins' group to receive the 'admin' role in Splunk. What must be configured in Splunk to achieve this?

A Splunk administrator has configured SAML SSO. Users can authenticate successfully, but all users are receiving the 'user' role regardless of their group memberships in the identity provider. What is the most likely cause?

Keep studying — Access and Roles