Splunk Exam SPLK-3001 Topic 1 Question 73 Discussion

Actual exam question for Splunk's SPLK-3001 exam

Question #: 73
Topic #: 1

Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events.

How would the admin restrict these users from being able to change the status of Resolved notable events to Closed?

AIn Enterprise Security, give the ess_user role the Own Notable Events permission.

BFrom the Status Configuration window select the Closed status. Remove ess_user from the status
transitions for the Resolved status.

CFrom the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the Closed status.

DFrom Splunk Access Controls, select the ess_user role and remove the edit_notable_events
capability.

Show Suggested Answer

Suggested Answer: A

by Chaya at Aug 05, 2023, 05:42 AM

Limited Time Offer

25%

Off

Get Premium SPLK-3001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Gussie

1 months ago

Option C looks promising. By removing the ess_user from the status transitions for the Closed status, they won't be able to change the status of Resolved notable events.

upvoted 0 times

Cordell

15 hours ago

Option C looks promising. By removing the ess_user from the status transitions for the Closed status, they won't be able to change the status of Resolved notable events.

upvoted 0 times

...

2 months ago

Option B seems the way to go. Removing the ess_user role from the status transitions for the Resolved status will do the trick.

upvoted 0 times

Clement

1 months ago

User 2: Agreed, removing ess_user from the status transitions for the Resolved status will prevent them from changing the status to Closed.

upvoted 0 times

...

Miss

2 months ago

User 1: I think option B is the best choice.

upvoted 0 times

...

Kristal

2 months ago

But wouldn't giving the ess_user role the Own Notable Events permission also help restrict them from closing events?

upvoted 0 times

...

Erick

2 months ago

I agree with Gerald. That way, ess_user won't be able to change the status of Resolved notable events to Closed.

upvoted 0 times

...

Gerald

2 months ago

I think the admin should remove ess_user from the status transitions for the Closed status.

upvoted 0 times

...