Splunk
SPLK-3001 · Question #43
SPLK-3001 Question #43: Real Exam Question with Answer & Explanation
Sign in or unlock SPLK-3001 to reveal the answer and full explanation for question #43. The question stem and answer options stay visible for context.
Question
Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events. How would the admin restrict these users from being able to change the status of Resolved notable events to Closed?
Options
- AIn Enterprise Security, give the ess_user role the Own Notable Events permission.
- BFrom the Status Configuration window select the Closed status. Remove ess_user from the status
- CFrom the Status Configuration window select the Resolved status. Remove ess_user from the
- DFrom Splunk Access Controls, select the ess_user role and remove the edit_notable_events
Unlock SPLK-3001 to see the answer
You've previewed enough free SPLK-3001 questions. Unlock SPLK-3001 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.