Which of the following is true when authenticating users to Splunk using LDAP?
A.
LDAP group names must match the Splunk role name defined in authorize.conf.
B.
Splunk will search each LDAP strategy in the order in which they are listed in authentication.conf.
C.
Splunk only supports encrypted LDAP connections.
D.
LDAP will take precedence over local users with the same username as defined in etc/passwd.
The Answer Is:
B
This question includes an explanation.
Explanation:
When configuring multiple LDAP strategies in Splunk, the order in which they are listed in the authentication.conf file determines the sequence in which Splunk searches them during authentication.
From the official Splunk documentation:
"To configure multiple LDAP strategies, set the authSettings setting to a comma-separated list of all strategies, in the order in which you want to query the strategies."
— Configure LDAP using configuration files - Splunk Documentation
Therefore, Splunk will search each LDAP strategy in the order specified in the authSettings parameter of the authentication.conf file.