Labour Day Special 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: exams65

Splunk SOAR Certified Automation Developer Exam Question and Answers

Splunk SOAR Certified Automation Developer Exam

Last Update May 1, 2024
Total Questions : 96

We are offering FREE SPLK-2003 Splunk exam questions. All you do is to just go and sign up. Give your details, prepare SPLK-2003 free exam questions and then go for complete pool of Splunk SOAR Certified Automation Developer Exam test questions that will help you more.

SPLK-2003 pdf

SPLK-2003 PDF

$35  $99.99
 Add to Cart
SPLK-2003 Engine

SPLK-2003 Testing Engine

$42  $119.99
 Add to Cart
SPLK-2003 PDF + Engine

SPLK-2003 PDF + Testing Engine

$56  $159.99
 Add to Cart
Questions 1

How is it possible to evaluate user prompt results?

Options:

A.  

Set action_result.summary. status to required.

B.  

Set the user prompt to reinvoke if it times out.

C.  

Set action_result. summary. response to required.

D.  

Add a decision Mode

Discussion 0
Questions 2

A customer wants to design a modular and reusable set of playbooks that all communicate with each other. Which of the following is a best practice for data sharing across playbooks?

Options:

A.  

Use the py-postgresq1 module to directly save the data in the Postgres database.

B.  

Cal the child playbooks getter function.

C.  

Create artifacts using one playbook and collect those artifacts in another playbook.

D.  

Use the Handle method to pass data directly between playbooks.

Discussion 0
Questions 3

What do assets provide for app functionality?

Options:

A.  

Assets provide location, credentials, and other parameters needed to run actions.

B.  

Assets provide hostnames, passwords, and other artifacts needed to run actions.

C.  

Assets provide Python code, REST API, and other capabilities needed to run actions.

D.  

Assets provide firewall, network, and data sources needed to run actions.

Discussion 0
Questions 4

Where can the Splunk App for SOAR Export be downloaded from?

Options:

A.  

GitHub and Splunkbase.

B.  

SOAR Community and GitHub.

C.  

Splunkbase and SOAR Community.

D.  

Splunk Answers and Splunkbase.

Discussion 0
Questions 5

How can an individual asset action be manually started?

Options:

A.  

With the > action button in the analyst queue page.

B.  

By executing a playbook in the Playbooks section.

C.  

With the > action button in the Investigation page.

D.  

With the > asset button in the asset configuration section.

Discussion 0
Questions 6

Which of the following roles is appropriate for a Splunk SOAR account that will only be used to execute automated tasks?

Options:

A.  

Non-Human

B.  

Automation

C.  

Automation Engineer

D.  

Service Account

Discussion 0
Questions 7

Which of the following expressions will output debug information to the debug window in the Visual Playbook Editor?

Options:

A.  

phantom.debug()

B.  

phantom.exception()

C.  

phantom.print ()

D.  

phantom.assert()

Discussion 0
Questions 8

Which two playbook blocks can discern which path in the playbook to take next?

Options:

A.  

Prompt and decision blocks.

B.  

Decision and action blocks.

C.  

Filter and decision blocks.

D.  

Filter and prompt blocks.

Discussion 0
Questions 9

During a second test of a playbook, a user receives an error that states: 'an empty parameters list was passed to phantom.act()." What does this indicate?

Options:

A.  

The container has artifacts not parameters.

B.  

The playbook is using an incorrect container.

C.  

The playbook debugger's scope is set to new.

D.  

The playbook debugger's scope is set to all.

Discussion 0
Questions 10

Phantom supports multiple user authentication methods such as LDAP and SAML2. What other user authentication method is supported?

Options:

A.  

SAML3

B.  

PIV/CAC

C.  

Biometrics

D.  

OpenID

Discussion 0
Questions 11

In this image, which container fields are searched for the text "Malware"?

Options:

A.  

Event Name and Artifact Names.

B.  

Event Name, Notes, Comments.

C.  

Event Name or ID.

Discussion 0
Questions 12

Which is the primary system requirement that should be increased with heavy usage of the file vault?

Options:

A.  

Amount of memory.

B.  

Number of processors.

C.  

Amount of storage.

D.  

Bandwidth of network.

Discussion 0
Questions 13

How can the DECIDED process be restarted?

Options:

A.  

By restarting the playbook daemon.

B.  

On the System Health page.

C.  

In Administration > Server Settings.

D.  

By restarting the automation service.

Discussion 0
Questions 14

A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes. What is the cause of this behavior?

Options:

A.  

Synchronous execution has not been configured.

B.  

The first playbook is performing poorly.

C.  

The sleep option for the second playbook is not set to a long enough interval.

D.  

Incorrect join configuration on the second playbook.

Discussion 0
Questions 15

How can a child playbook access the parent playbook's action results?

Options:

A.  

Child playbooks can access parent playbook data while the parent Is still running.

B.  

By setting scope to ALL when starting the child.

C.  

When configuring the playbook block in the parent, add the desired results in the Scope parameter.

D.  

The parent can create an artifact with the data needed by the did.

Discussion 0
Questions 16

Without customizing container status within Phantom, what are the three types of status for a container?

Options:

A.  

New, In Progress, Closed

B.  

Low, Medium, High

C.  

Mew, Open, Resolved

D.  

Low, Medium, Critical

Discussion 0
Questions 17

If no data matches any filter conditions, what is the next block run by the playbook?

Options:

A.  

The end block.

B.  

The start block.

C.  

The filter block.

D.  

The next block.

Discussion 0
Questions 18

What values can be applied when creating Custom CEF field?

Options:

A.  

Name

B.  

Name, Data Type

C.  

Name, Value

D.  

Name, Data Type, Severity

Discussion 0
Questions 19

Some of the playbooks on the Phantom server should only be executed by members of the admin role. How can this rule be applied?

Options:

A.  

Add a filter block to al restricted playbooks that Titters for runRole - "Admin''.

B.  

Add a tag with restricted access to the restricted playbooks.

C.  

Make sure the Execute Playbook capability is removed from al roles except admin.

D.  

Place restricted playbooks in a second source repository that has restricted access.

Discussion 0
Questions 20

How can more than one user perform tasks in a workbook?

Options:

A.  

Any user in a role with write access to the case's workbook can be assigned to tasks.

B.  

Add the required users to the authorized list for the container.

C.  

Any user with a role that has Perform Task enabled can execute tasks for workbooks.

D.  

The container owner can assign any authorized user to any task in a workbook.

Discussion 0
Questions 21

On a multi-tenant Phantom server, what is the default tenant's ID?

Options:

A.  

0

B.  

Default

C.  

1

D.  

*

Discussion 0
Questions 22

Which Phantom VPE Nock S used to add information to custom lists?

Options:

A.  

Action blocks

B.  

Filter blocks

C.  

API blocks

D.  

Decision blocks

Discussion 0
Questions 23

When writing a custom function that uses regex to extract the domain name from a URL, a user wants to create a new artifact for the extracted domain. Which of the following Python API calls will create a new artifact?

Options:

A.  

phantom.new_artifact ()

B.  

phantom. update ()

C.  

phantom.create_artifact ()

D.  

phantom.add_artifact ()

Discussion 0
Questions 24

What is the default log level for system health debug logs?

Options:

A.  

INFO

B.  

WARN

C.  

ERROR

D.  

DEBUG

Discussion 0
Questions 25

A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?

Options:

A.  

Null IP addresses

B.  

Non-null IP addresses

C.  

Non-null destinationAddresses

D.  

Null values

Discussion 0
Questions 26

Some of the playbooks on the SOAR server should only be executed by members of the admin role. How can this rule be applied?

Options:

A.  

Make sure the Execute Playbook capability is removed from all roles except admin.

B.  

Place restricted playbooks in a second source repository that has restricted access.

C.  

Add a filter block to all restricted playbooks that filters for runRole = "Admin".

D.  

Add a tag with restricted access to the restricted playbooks.

Discussion 0
Questions 27

Which of the following describes the use of labels in Phantom?

Options:

A.  

Labels determine the service level agreement (SLA) for a container.

B.  

Labels control the default seventy, ownership, and sensitivity for the container.

C.  

Labels control which apps are allowed to execute actions on the container.

D.  

Labels determine which playbook(s) are executed when a container is created.

Discussion 0
SPLK-2003 Questions Answers | SPLK-2003 Test Prep | Splunk SOAR Certified Automation Developer Exam Questions PDF | SPLK-2003 Online Exam | SPLK-2003 Practice Test | SPLK-2003 PDF | SPLK-2003 Test Questions | SPLK-2003 Study Material | SPLK-2003 Exam Preparation | SPLK-2003 Valid Dumps | SPLK-2003 Real Questions | Splunk SOAR Certified Automation Developer SPLK-2003 Exam Questions