SPLK-3003 Exam - Question 38

Question

A customer has implemented their own Role Based Access Control (RBAC) model to attempt to give the Security team different data access than the Operations team by creating two new Splunk roles "" security and operations. In the srchIndexesAllowed setting of authorize.conf, they specified the network index under the security role and the operations index under the operations role. The new roles are set up to inherit the default user role.

If a new user is created and assigned to the operations role only, which indexes will the user have access to search?

Examice · Accepted Answer

If a new user is assigned to the operations role only, they will have access to the operations index. Additionally, since the role inherits from the default user role, the user will have access to all non-internal indexes by default. Therefore, the user will have access to the operations and network indexes.

Vin1118 · Answer

I think D. By default, user have access to all non-internal indexes

nutsu · Answer

answer D,
default user role not see internal index and default see non-internal index

tico2k · Answer

The correct answer is D

simplekindaman · Answer

Agreed...  answer is D, for reason Vin1118 mentions

Redtonyeah · Answer

D is OK

huu_nguyen · Answer

D is the one, by default, the user does have access to all non-internal indexes but not to internal indexes

ranga19 · Answer

D ,By default, user have access to all non-internal indexes.

spl_bonn · Answer

D is the correct one. user role is by default has access to all non-internal indexes

da_stingo · Answer

I am really struggling with your answers, boys. When I look up the users role which comes preinstalled with every splunk install by default, I do NOT see that users have access to all non-indexes. Do you have another source of truth for answering this question beside looking of the role info page showing which index the role is allowed to search?

SplunkStreamer · Answer

D, by default the user role has access to all non-internal indexes.

SPLK-3003 Exam - Question 38

Discussion