Free SPLK-2003 Sample Questions — Splunk SOAR Certified Automation Developer

To limit the impact of custom code on the VPE, where should the custom code be placed?

• A. separate container
• B. separate code repository
• C. custom function block
• D. custom container or a separate KV store

When the Splunk App for SOAR Export executes a Splunk search, which activities are completed?

• A. CEF fields are mapped to CIM and a container is created on the Splunk server
• B. CIM fields are mapped to CEF and a container is created on the Splunk server
• C. CEF fields are mapped to CIM fields and a container is created on the SOAR server
• D. CIM fields are mapped to CEF fields and a container is created on the SOAR server

Splunk user account(s) with which roles must be created to configure SOAR with an external Splunk Enterprise instance?

• A. phantomsearch, phantomdelete
• B. phantomcreate, phantomedit
• C. superuser, administrator
• D. admin, user

Which of the following applies to filter blocks?

• A. Can select containers by severity or status
• B. Can select assets by tenant, approver, or app
• C. Can select which blocks have access to container data
• D. Can be used to select data for use by other blocks

A user selects the New option under Sources on the menu. What will be displayed?

• A. list of new assets
• B. list of new events
• C. list of new data sources
• D. The New Data Ingestion wizard

How can the DECIDED process be restarted?

• A. By restarting the automation service
• B. By restarting the playbook daemon
• C. In Administration > Server Settings
• D. On the System Health page

Which of the following can be done with the System Health Display?

• A. Partially rewind processes, which is useful for debugging
• B. Create a temporary, edited version of a process and test the results
• C. Reset DECIDED to reset playbook environments back to at-start conditions
• D. View a single column of status for SOAR processes. For metrics, click Details

Which visual playbook editor block is used to assemble commands and data into a valid Splunk search within a SOAR playbook?

• A. An action block
• B. filter block
• C. prompt block
• D. format block

What are indicators?

• A. Artifact values that can appear in multiple containers
• B. Action results that may appear in multiple containers
• C. Artifact values with special security significance
• D. Action result items that determine the flow of execution in a playbook

Which of the following are tabs of an asset configuration?

• A. Asset Info, Asset Settings, Approval Settings, Access Control
• B. Asset Name, Asset IP, Asset URL, Asset Nickname
• C. Tags, Asset Name, Asset Date, Asset Order
• D. App Name, App Order, App Expiry, App Version