On the deployment server, administrators can map clients to server classes using client filters. Which of the following statements is accurate?

The correct answer is A. The blacklist takes precedence over the whitelist. In Splunk's deployment server server class filtering, the blacklist always takes precedence over the whitelist. If a client matches both a whitelist entry and a blacklist entry, the blacklist wins and the client is excluded from that server class. This security-first design…

Splunk Deployment and Licensing

Question

Options

AThe blacklist takes precedence over the whitelist.
BThe whitelist takes precedence over the blacklist.
CWildcards are not supported in any client filters.
DMachine type filters are applied before the whitelist and blacklist.

How the community answered

(39 responses)

A
87% (34)
B
3% (1)
C
3% (1)
D
8% (3)

Explanation

In Splunk's deployment server server class filtering, the blacklist always takes precedence over the whitelist. If a client matches both a whitelist entry and a blacklist entry, the blacklist wins and the client is excluded from that server class. This security-first design ensures that explicit exclusions cannot be accidentally overridden by broad whitelist patterns. Wildcards are supported in both whitelist and blacklist filters (making C incorrect), and machine type filters are not evaluated before whitelist/blacklist (making D incorrect).

Topics

#Deployment Server#Client Filters#Server Classes#Blacklist/Whitelist Precedence

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice