Splunk Enterprise Security Certified Analyst — Question 72

A customer is using both internal Splunk authentication and LDAP for user management.
If a username exists in both $SPLUNK_HOME/etc/passwd and LDAP, which of the following statements is accurate?

Answer options

• A. The internal Splunk authentication will take precedence.
• B. Authentication will only succeed if the password is the same in both systems.
• C. The LDAP user account will take precedence.
• D. Splunk will error as it does not support overlapping usernames

Correct answer: A

Explanation

The correct answer is A because Splunk prioritizes its internal authentication over LDAP when both have the same username. Options B and C are incorrect as the password does not need to match and the LDAP user does not take precedence. Option D is also incorrect since Splunk can handle overlapping usernames without error.