Splunk Enterprise Security Certified Analyst — Question 42

How does Monitoring Console (MC) initially identify the server role(s) of a new Splunk Instance?

Answer options

• A. The MC uses a REST endpoint to query the server.
• B. Roles are manually assigned within the MC.
• C. Roles are read from distsearch.conf.
• D. The MC assigns all possible roles by default.

Correct answer: A

Explanation

The correct answer is A because the Monitoring Console identifies server roles by making a query to a REST endpoint that provides this information. The other options are incorrect as roles cannot be manually assigned in the MC, cannot be read from distsearch.conf for initial identification, and the MC does not assign all roles by default.