ExamGecko
Question list
Search
Search

Question 67 - SPLK-2003 discussion

Report
Export

Some of the playbooks on the SOAR server should only be executed by members of the admin role. How can this rule be applied?

A.

Make sure the Execute Playbook capability is removed from all roles except admin.

Answers
A.

Make sure the Execute Playbook capability is removed from all roles except admin.

B.

Place restricted playbooks in a second source repository that has restricted access.

Answers
B.

Place restricted playbooks in a second source repository that has restricted access.

C.

Add a filter block to all restricted playbooks that filters for runRole = 'Admin'.

Answers
C.

Add a filter block to all restricted playbooks that filters for runRole = 'Admin'.

D.

Add a tag with restricted access to the restricted playbooks.

Answers
D.

Add a tag with restricted access to the restricted playbooks.

Suggested answer: A

Explanation:

To restrict playbook execution to members of the admin role within Splunk SOAR, the 'Execute Playbook' capability must be managed appropriately. This is done by ensuring that this capability is removed from all other roles except the admin role. Role-based access control (RBAC) in Splunk SOAR allows for granular permissions, which means you can configure which roles have the ability to execute playbooks, and by restricting this capability, you can control which users are able to initiate playbook runs.

asked 13/11/2024
Maxime ESSIS
38 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first