Question 1
An admin updates the Role to Group mapping for external authentication. How does the change affect users that are currently logged into Splunk?
- AOption A:
Users will continue to operate under their previous role until the next time they log into Splunk.
- BOption B:
Search is disabled until users reauthenticate.
- COption C:
Only newly created user accounts are affected by the role change.
- DOption D:
The role update terminates the user’s current session, and they have to log back in.
Show answer and explanation
Correct answer: A
Splunk checks role-to-group mapping only during user login for external authentication (e.g., LDAP, SAML). Users already logged in will continue using their previously assigned roles until they log out and log back in.
The changes to role mapping do not disrupt ongoing sessions.
Incorrect Options:
B:Search is not disabled upon role updates.
C:This is incorrect since existing users are also updated upon the next login.
D:Role updates do not terminate ongoing sessions.