Question 20 - SPLK-2003 discussion

Suggested answer: C

Explanation:

The correct answer is C because the best way to restrict the execution of playbooks tomembers of the admin role is to make sure the Execute Playbook capability is removed from allroles except admin. The Execute Playbook capability is a permission that allows a user to runany playbook on any container. By default, all roles have this capability, but it can be removedor added in the Phantom UI by going to Administration > User Management > Roles. Removingthis capability from all roles except admin will ensure that only admin users can executeplaybooks. SeeSplunk SOAR Documentationfor more details. To ensure that only members of
the admin role can execute specific playbooks on the Phantom server, the most effectiveapproach is to manage role-based access controls (RBAC) directly. By configuring the system toremove the 'Execute Playbook' capability from all roles except for the admin role, you canenforce this rule. This method leverages Phantom's built-in RBAC mechanisms to restrictplaybook execution privileges. It is a straightforward and secure way to ensure that only userswith the necessary administrative privileges can initiate the execution of sensitive or criticalplaybooks, thus maintaining operational security and control.