Splunk Exam SPLK-1005 Topic 9 Question 5 Discussion

Actual exam question for Splunk's SPLK-1005 exam

Question #: 5
Topic #: 9

[All SPLK-1005 Questions]

By default, which of the following capabilities are granted to the sc_admin role?

Aindexes_edit, edit___token, admin_all_objects, delete_by_keyword

Bindexes_edit, fsh_manage, acs_conf, list_indexesdiscovert

Cindexes_edit, fsh_manage, admin_all_objects can_delete

Dindexes_edit, edit_token_http, admin _all objects, edit limits_conf

Show Suggested Answer

Suggested Answer: C

By default, the sc_admin role in Splunk Cloud is granted several important capabilities, including:

indexes_edit: The ability to create, edit, and manage indexes.

fsh_manage: Manage full-stack monitoring integrations.

admin_all_objects: Full administrative control over all objects in Splunk.

can_delete: The ability to delete events using the delete command.

Option C correctly lists these default capabilities for the sc_admin role.

Splunk Documentation Reference: User roles and capabilities

by Dustin at Oct 19, 2024, 03:15 PM

Limited Time Offer

25%

Off

Get Premium SPLK-1005 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ty

7 months ago

Wait, there's a 'delete_by_keyword' capability? That sounds like a dangerous one to have in the wrong hands. I bet the sc_admin role doesn't get that one by default.

upvoted 0 times

...

Shawana

7 months ago

This is a tricky one! I'm leaning towards B, but I'll have to double-check the documentation to be sure. Gotta love these Splunk certification questions, am I right?

upvoted 0 times

Lonny

6 months ago

I remember seeing something about A, let me look it up to confirm.

upvoted 0 times

...

Veronika

6 months ago

I'm pretty sure it's D, but let me verify that.

upvoted 0 times

...

Christa

7 months ago

I think it might be C actually, but I'm not 100% sure.

upvoted 0 times

...

Nobuko

7 months ago

I'm no Splunk expert, but I'm gonna go with A just to be different. You know what they say, 'The answer is always the one nobody picks!'

upvoted 0 times

...

Doretha

7 months ago

Hmm, I think D might be the correct answer. The 'edit_token_http' and 'edit_limits_conf' capabilities sound like they could be included in the sc_admin role.

upvoted 0 times

...