Splunk Enterprise Certified Admin Practice Test

In cases of conflict between a whitelist and blacklist, which takes precedence?

1. Whitelist

2. Blacklist

3. Neither

4. Both are combined

The correct answer is: Blacklist

In situations involving a whitelist and a blacklist, the principle of using a blacklist typically takes precedence. A whitelist is a list of approved items or entities that are allowed, meaning anything not on the whitelist may be considered restricted. Conversely, a blacklist specifically identifies items or entities that are prohibited. When there is a conflict—meaning an item appears on both lists—the logical approach is to deny access based on the blacklist's prohibitive nature. This dynamic supports a secure environment where blacklisted items are actively prevented from inclusion or access, thereby enforcing stronger security measures. Thus, even if an item is whitelisted, if it also appears on the blacklist, the indication is that it should be blocked. The practical implication is that the blacklist serves as a more immediate measure for controlling access, particularly in cybersecurity contexts where the risks associated with allowing blacklisted items can be severe.