Authentication Integration SPLK-1003 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the core concept of multifactor authentication (MFA)?

   • ARequiring two or more independent credentials to verify a user's identity
   • BUsing a single strong password for all users
   • CEncrypting all user passwords in the database
   • DAutomatically locking accounts after failed attempts
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security auditor recommends that all Splunk administrative accounts use multifactor authentication. The Splunk admin has already configured an MFA provider. What is the next step to ensure that the 'admin' role requires MFA?

   • AAdd the 'admin' role to the LDAP group that is mapped to MFA.
   • BEnable MFA enforcement for the 'admin' role in the MFA settings.
   • CManually send MFA tokens to all users with the admin role.
   • DCreate a new authentication method that includes MFA for the admin role.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A Splunk admin is comparing LDAP and SAML for a new deployment. The company has a large Active Directory environment and wants to use existing AD credentials. However, they also want to support SSO for other web applications. Which approach best meets both requirements?

   • AUse LDAP authentication for Splunk and separate SSO for other apps.
   • BUse SAML with an identity provider that federates with Active Directory.
   • CUse scripted authentication to bridge LDAP and SAML.
   • DUse native Splunk authentication and sync AD users manually.
   Reveal Solution Discussion Select an answer first
5. 24application · easy

   A Splunk admin is considering different authentication methods for a small team that does not have an existing LDAP or SAML infrastructure. The team wants the simplest setup with minimal external dependencies. Which authentication method should the admin choose?

   • ALDAP authentication
   • BScripted authentication
   • CNative Splunk authentication
   • DSAML authentication
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is integrating Splunk Enterprise with its existing Active Directory. The security team wants all users authenticated against AD, but only members of the 'splunk_admins' AD group should receive the 'admin' role in Splunk. The Splunk admin has already created an LDAP strategy and added the LDAP server. What must the admin do next to ensure the AD group members receive admin privileges?

   • ACreate a role mapping that associates the 'splunk_admins' LDAP group with the 'admin' Splunk role.
   • BConfigure the LDAP strategy to use 'admin' as the default role for all authenticated users.
   • CAssign the 'admin' role directly to each user account in Splunk's native authentication.
   • DEnable the 'admin' role in the LDAP server's group attributes.
   Reveal Solution Discussion Select an answer first