Splunk
SPLK-3003 · Question #69
SPLK-3003 Question #69: Real Exam Question with Answer & Explanation
The correct answer is D. Clone the default user role, remove the output_file capability, and assign it to the users.. If new role will inherit user role, user role will have the capabilities from user role, you cannot remove it from new role but if you clone it, it would be possible.
Question
A customer would like to remove the output_file capability from users with the default user role to stop them from filling up the disk on the search head with lookup files. What is the best way to remove this capability from users?
Options
- ACreate a new role without the output_file capability that inherits the default user role and assign it
- BCreate a new role with the output_file capability that inherits the default user role and assign it to
- CEdit the default user role and remove the output_file capability.
- DClone the default user role, remove the output_file capability, and assign it to the users.
Explanation
If new role will inherit user role, user role will have the capabilities from user role, you cannot remove it from new role but if you clone it, it would be possible.
Community Discussion
No community discussion yet for this question.