Splunk Enterprise Certified Admin Practice Test

A user with 'edit_roles' and 'edit_user' capabilities can promote themselves to which role?

1. Power user

2. Admin role

3. User role

4. Can delete role

The correct answer is: Admin role

A user with 'edit_roles' and 'edit_user' capabilities has the ability to modify the roles and users within Splunk. The 'edit_roles' capability allows the user to create, modify, and delete roles. Since the Admin role is the highest privilege role in Splunk, users with the mentioned capabilities can promote themselves to this level. The Admin role encompasses all permissions and can manage everything within the Splunk environment, including user management and role assignments. Therefore, it is fitting that a user with permissions to edit roles and user accounts would be able to elevate themselves to the Admin role, which is essential for full administrative control. In contrast, while other roles—like Power user, User, or Can delete role—are available, they do not reflect the full extent of privileges that the Admin role provides. Thus, opting for anything lower than the Admin role would not utilize the granted capabilities effectively.