Splunk Core Certified Consultant — Question 6

By default, which of the following capabilities are granted to the sc_admin role?

Answer options

• A. indexes_edit, edit_token_http, admin_all_objects, delete_by_keyword
• B. indexes_edit, fsh_manage, acs_conf, list_indexerdiscovery
• C. indexes_edit, fsh_manage, admin_all_objects, can_delete
• D. indexes_edit, edit_token_http, admin_all_objects, edit_limits_conf

Correct answer: C

Explanation

The correct answer, C, includes permissions that allow for managing indexes and administration tasks, which are aligned with the responsibilities of the sc_admin role. Options A, B, and D include permissions that either do not belong to the sc_admin role or do not correctly reflect the default capabilities assigned.