Following the Installation of ES, an Admin Configured Users with the Ess_user

question 40

Multiple Choice

Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events. How would the admin restrict these users from being able to change the status of Resolved notable events to Closed ?

• A) In Enterprise Security, give the ess_user role the Own Notable Events permission. In Enterprise Security, give the role the Own Notable Events permission.
• B) From the Status Configuration window select the Closed status. Remove ess_user from the status transitions for the Resolved status. From the Status Configuration window select the status. Remove from the status transitions for the status.
• C) From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the Closed status.
• D) From Splunk Access Controls, select the ess_user role and remove the edit_notable_events capability. From Splunk Access Controls, select the role and remove the edit_notable_events capability.

---

Definitions:

MPS

The marginal propensity to save, which is the fraction of an additional unit of income that is saved rather than spent.

Expected Rate of Profit

The anticipated return on investment, representing the gain or loss compared to the initial investment amount.

Interest Rate

The percentage of a sum of money charged for its use, typically expressed as an annual percentage.

Unlimited Liability

A legal structure in which the owners of a business are personally liable for all the debts and obligations of the business, extending beyond the amount invested.