Splunk Enterprise Certified Admin Practice Test

When mapping LDAP/SAML groups to roles, which statement is true?

1. A user must have a Splunk role in order to log in.

2. Mappings can be changed at any time.

3. All groups must be mapped.

4. Only time zone and default app can be changed on LDAP or other users.

The correct answer is: A user must have a Splunk role in order to log in.

The statement that a user must have a Splunk role in order to log in is true because Splunk uses role-based access control to manage user permissions and access to resources. Each user must be assigned at least one role to define what capabilities they have within the Splunk environment. This requirement ensures that all users have appropriate access levels and security settings, as roles determine permissions to search, index data, and use apps. When users are authenticated through LDAP or SAML, these external identities must still be mapped to Splunk roles; otherwise, the users would not be able to log in and interact with the system as intended. This ensures a seamless integration of external identity management systems with Splunk's internal security and access configurations. In terms of the other statements, while mappings can be modified, there are guidelines and timing considerations; it's also not mandatory to map all groups, as some may not need access at all; and the capabilities of user management extend beyond just the time zone and default app settings. Hence, the requirements for role assignment remain paramount for user logins.