Splunk Enterprise Certified Admin Practice Test

Which of the following statements about new roles in Splunk is NOT true?

1. A new role can be based on one or more existing roles.

2. A new role inherits capabilities.

3. A new role inherits index access.

4. You can disable inherited capabilities or access.

The correct answer is: You can disable inherited capabilities or access.

The statement that is NOT true regarding new roles in Splunk is that you can disable inherited capabilities or access. In Splunk, when you create a new role based on existing ones, the new role automatically inherits the capabilities assigned to the underlying roles, as well as the access to specific indices. However, while you can customize the capabilities for a new role, you cannot directly remove inherited capabilities or index access; the new role will always maintain at least the permissions of the role(s) it is derived from. The first three statements reflect accurate characteristics of Splunk roles. A new role can indeed be created based on one or more existing roles, allowing for flexibility and reuse of permissions. Additionally, the inheritance of capabilities means that a new role inherently comes with the abilities assigned to its parent roles. Similarly, the new role inherits index access, ensuring that the data visibility aligns with what is configured in the parent roles. This structure allows for both a hierarchical setup of permissions and an efficient method to manage access control without needing to set everything from scratch for each new role.