Exam SPLK-3003 topic 1 question 38 discussion

Actual exam question from Splunk's SPLK-3003

Question #: 38
Topic #: 1

A customer has implemented their own Role Based Access Control (RBAC) model to attempt to give the Security team different data access than the Operations team by creating two new Splunk roles "" security and operations. In the srchIndexesAllowed setting of authorize.conf, they specified the network index under the security role and the operations index under the operations role. The new roles are set up to inherit the default user role.
If a new user is created and assigned to the operations role only, which indexes will the user have access to search?

A. operations, network, _internal, _audit
B. operations
C. No Indexes
D. operations, network

Show Suggested Answer

Suggested Answer: D 🗳️

by Vin1118 at Jan. 15, 2021, 10:09 a.m.

Comments

Submit Cancel

Vin1118

Highly Voted 3 years, 6 months ago

I think D. By default, user have access to all non-internal indexes

upvoted 10 times

...

SplunkStreamer

Most Recent 2 months, 2 weeks ago

Selected Answer: D

D, by default the user role has access to all non-internal indexes.

upvoted 1 times

...

da_stingo

1 year ago

Selected Answer: B

I am really struggling with your answers, boys. When I look up the users role which comes preinstalled with every splunk install by default, I do NOT see that users have access to all non-indexes. Do you have another source of truth for answering this question beside looking of the role info page showing which index the role is allowed to search?

upvoted 1 times