ExamGecko
Login
Home / Splunk / SPLK-2003
Ask Question

SPLK-2003: Splunk SOAR Certified Automation Developer

Vendor:
Exam Questions:
96
 Learners
  2.370
Last Updated
March - 2025
Language
English
3 Quizzes
PDF | VPLUS
This study guide should help you understand what to expect on the exam and includes a summary of the topics the exam might cover and links to additional resources. The information and materials in this document should help you focus your studies as you prepare for the exam.

Related questions

Question 1

Report Export Collapse

How is it possible to evaluate user prompt results?

Set action_result.summary. status to required.
Set action_result.summary. status to required.
Set the user prompt to reinvoke if it times out.
Set the user prompt to reinvoke if it times out.
Set action_result. summary. response to required.
Set action_result. summary. response to required.
Add a decision Mode
Add a decision Mode
Suggested answer: C
Explanation:

In Splunk Phantom, user prompts are actions that require human input. To evaluate the resultsof a user prompt, you can set the response requirement in the action result summary. Bysetting action_result.summary.response to required, the playbook ensures that it captures theuser's input and can act upon it. This is critical in scenarios where subsequent actions dependon the choices made by the user in response to a prompt. Without setting this, the playbookwould not have a defined way to handle the user response, which might lead to incorrect orunexpected playbook behavior.

asked 23/09/2024
Venkatesh Ampolu
47 questions

Question 2

Report Export Collapse

Some of the playbooks on the SOAR server should only be executed by members of the admin role. How can this rule be applied?

Become a Premium Member for full access
  Unlock Premium Member

Question 3

Report Export Collapse

Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment' Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.

On the command line enter: rode sudo python ibackup.pyc --setup, then audo phenv python ibackup.pyc --backup.
On the command line enter: rode sudo python ibackup.pyc --setup, then audo phenv python ibackup.pyc --backup.
On the command line enter: sudo phenv python ibackup.pyc --backup —backup-type full, then sudo phenv python ibackup.pyc --setup.
On the command line enter: sudo phenv python ibackup.pyc --backup —backup-type full, then sudo phenv python ibackup.pyc --setup.
Within the UI: Select from the main menu Administration > System Health > Backup.
Within the UI: Select from the main menu Administration > System Health > Backup.
Within the UI: Select from the main menu Administration > Product Settings > Backup.
Within the UI: Select from the main menu Administration > Product Settings > Backup.
Suggested answer: B
asked 23/09/2024
Paul Schwarz
45 questions

Question 4

Report Export Collapse

What does a user need to do to have a container with an event from Splunk use context-aware actions designed for notable events?

Include the notable event's event_id field and set the artifacts label to aplunk notable event id.
Include the notable event's event_id field and set the artifacts label to aplunk notable event id.
Rename the event_id field from the notable event to splunkNotableEventld.
Rename the event_id field from the notable event to splunkNotableEventld.
Include the event_id field in the search results and add a CEF definition to Phantom for event_id, datatype splunk notable event id.
Include the event_id field in the search results and add a CEF definition to Phantom for event_id, datatype splunk notable event id.
Add a custom field to the container named event_id and set the custom field's data type to splunk notable event id.
Add a custom field to the container named event_id and set the custom field's data type to splunk notable event id.
Suggested answer: C
Explanation:

For a container in Splunk SOAR to utilize context-aware actions designed for notable eventsfrom Splunk, it is crucial to ensure that the notable event's unique identifier (event_id) isincluded in the search results pulled into SOAR. Moreover, by adding a Common Event Format(CEF) definition for the event_id field within Phantom, and setting its data type to somethingthat denotes it as a Splunk notable event ID, SOAR can recognize and appropriately handlethese identifiers. This setup facilitates the correct mapping and processing of notable eventdata within SOAR, enabling the execution of context-aware actions that are specifically tailoredto the characteristics of Splunk notable events.

asked 23/09/2024
Sullivan Dabireau
44 questions

Question 5

Report Export Collapse

How can the DECIDED process be restarted?

Become a Premium Member for full access
  Unlock Premium Member

Question 6

Report Export Collapse

Which Phantom API command is used to create a custom list?

Become a Premium Member for full access
  Unlock Premium Member

Question 7

Report Export Collapse

What are the components of the I2A2 design methodology?

Become a Premium Member for full access
  Unlock Premium Member

Question 8

Report Export Collapse

Which of the following can be configured in the ROI Settings?

Become a Premium Member for full access
  Unlock Premium Member

Question 9

Report Export Collapse

Which of the following applies to filter blocks?

Can select which blocks have access to container data.
Can select which blocks have access to container data.
Can select assets by tenant, approver, or app.
Can select assets by tenant, approver, or app.
Can be used to select data for use by other blocks.
Can be used to select data for use by other blocks.
Can select containers by seventy or status.
Can select containers by seventy or status.
Suggested answer: A
asked 23/09/2024
Francesco MARRELLA
40 questions

Question 10

Report Export Collapse

An active playbook can be configured to operate on all containers that share which attribute?

Artifact
Artifact
Label
Label
Tag
Tag
Severity
Severity
Suggested answer: B
asked 23/09/2024
Martien de Kleijn
34 questions