Covers SOAR installation and user management, configuring apps, assets and playbooks, the analyst queue and investigation page, the visual playbook editor, custom coding, and the REST API.
20 free sample questions207 in the full practice test
Modular Playbook Development · Invoke child playbooks from a parent
A SOAR developer is creating a playbook that needs to process a list of file hashes. For each hash, a child playbook is invoked to perform reputation analysis. The parent playbook must wait for all child playbooks to complete before aggregating the results. Which configuration in the parent playbook's 'Playbook' block is essential to achieve this requirement?
Answer and explanation
Correct answer: B
Checking the 'synchronous' checkbox ensures that the parent playbook pauses its execution and waits for the child playbook to complete before proceeding. This is critical for scenarios where the parent playbook depends on the output or completion of the child.
Q2Question 2
Intermediate
Formatted Output and Data Access · Compose datapaths to access data
A custom function in a Splunk SOAR playbook is designed to parse a complex, nested JSON object from an API response. The developer needs to extract a specific value located at results[0].indicators.domains[2].name. Which is the most robust datapath to access this value?
Answer and explanation
Correct answer: D
The correct datapath syntax uses bracket notation [index] to access elements in a list (array) and dot notation .key to access values in a dictionary (object). The other options use incorrect separators or wildcards that do not target the specific element.
Q3Question 3
AdvancedMultiple answers
Custom Coding · Write and test custom SOAR code
A developer needs to write a custom function that enriches multiple artifacts and then adds a single, consolidated note to the container. Which TWO of the following phantom library calls are essential for this task? (Select TWO)
Answer and explanation
Correct answers: A, C
phantom.act() is used to execute an action from within the custom function, which is necessary for the enrichment part of the task.
phantom.add_note() is used to programmatically add a note to the current container, which is required for the second part of the task.
Q4Question 4
Beginner
Logic, Filters, and User Interaction · Interact with users during playbook execution
True or False: When a playbook uses a 'Manual Task' block, the entire playbook execution pauses and enters a 'pending' state until a user manually marks the task as complete.
Answer and explanation
Correct answer: A
The 'Manual Task' block is designed specifically to halt playbook automation and assign a task to a user or role. The playbook will not proceed past this block until the task is manually completed in the SOAR UI.
Q5Question 5
Intermediate
Integrating SOAR into Splunk · Send Enterprise Security notables to SOAR
A financial institution is using Splunk SOAR to automate responses to phishing alerts originating from Splunk Enterprise Security (ES). They need to ensure that when a notable event from ES creates a container in SOAR, the original notable event's urgency is mapped to the SOAR container's severity. Where is this mapping configured?
Answer and explanation
Correct answer: C
The mapping of fields like urgency, sensitivity, and status from a Splunk ES notable event to a SOAR container's severity, sensitivity, and status is configured within the Splunk App for SOAR Export (formerly Phantom App for Splunk) on the Splunk search head where ES is installed.
Q6Question 6
Advanced
Modular Playbook Development · Design modular solutions with interacting playbooks
Case Study:
A managed security service provider (MSSP) uses a single Splunk SOAR instance to serve multiple tenants. They have developed a standardized 'Threat Intel Enrichment' playbook that is used by all tenants. Recently, a new premium tenant requires a slightly different enrichment process that involves an additional, proprietary threat intelligence source. The MSSP wants to avoid duplicating the entire playbook for one minor change.
The current playbook structure is a single, monolithic playbook. The MSSP wants to re-architect the solution to be more modular and maintainable. They need to create a solution where the core enrichment logic is shared, but the premium tenant's workflow includes the extra step. All tenants should use the same initial trigger.
Which approach best meets the MSSP's requirements for modularity and minimal duplication?
Answer and explanation
Correct answer: D
This approach is the most modular and scalable. It encapsulates the shared logic in a reusable child playbook ('Core Enrichment'). The parent playbook acts as a controller, handling the conditional logic to invoke the specialized 'Premium Enrichment' playbook only when necessary. This avoids duplicating the core logic and makes future modifications easier.
Q7Question 7
Intermediate
Custom Lists and Data Routing · Access lists from playbooks
A developer is building a playbook that queries a custom list containing network CIDR ranges and their corresponding business units. The playbook receives an IP address as an artifact and must find the correct business unit. The custom list is named business_unit_cidrs. Which block is best suited to perform this lookup directly within the visual playbook editor?
Answer and explanation
Correct answer: C
The Utility block provides a built-in 'cidr lookup' operation specifically for this use case. It allows the developer to provide an IP address and a custom list name, and it will automatically find the matching CIDR range and return the corresponding row from the list.
Q8Question 8
Advanced
Using REST · Use Django queries to search for data in SOAR
A SOAR administrator is tasked with retrieving all containers with a 'High' severity that were created in the last 7 days using the REST API. Which Django-style filter query should be used with the /rest/container endpoint?
Answer and explanation
Correct answer: C
This query correctly filters by the severity name and uses the __gte (greater than or equal to) operator with a relative time string now-7d/d. Filtering on severity__name is necessary because severity is a foreign key. Combining filters requires using separate _filter_ parameters for each condition.
Q9Question 9
Intermediate
Logic, Filters, and User Interaction · Describe the use of different join options
A developer notices that a playbook designed to block an IP address fails intermittently. The playbook uses two parallel action blocks to add the IP to two different firewalls. The playbook then proceeds to a single 'add note' block. The developer suspects a race condition. The following diagram shows the playbook flow. What is the most effective way to ensure both firewall blocks complete before the note is added?
graph TD
A[Start] --> B{Get IP Artifact};
B --> C[Block IP on FW1];
B --> D[Block IP on FW2];
C --> E[Add Note];
D --> E;
Answer and explanation
Correct answer: B
A 'Join' block is specifically designed to solve this problem. It synchronizes multiple parallel execution paths in a playbook, ensuring that all incoming paths have completed their execution before allowing the playbook to proceed to the next block. This eliminates the race condition.
Q10Question 10
Intermediate
Custom Coding · Use custom function blocks
When should a developer choose to use a Custom Function block over a series of native Visual Playbook Editor (VPE) blocks?
Answer and explanation
Correct answer: B
Custom Functions are ideal for tasks that require the power and flexibility of Python, such as iterating over large datasets, complex transformations, interacting with APIs that don't have a dedicated SOAR app, or implementing algorithms that are cumbersome to build with visual blocks.
Register free for 10 more questions
Or unlock all 207 SPLK-2003 questions with explanations, timed mode and flashcards.
