SPLK-2003 sample questions

Question 1

A SOAR developer is creating a playbook that needs to process a list of file hashes. For each hash, a child playbook is invoked to perform reputation analysis. The parent playbook must wait for all child playbooks to complete before aggregating the results. Which configuration in the parent playbook's 'Playbook' block is essential to achieve this requirement?

Accepted Answer

Check the 'synchronous' checkbox.

Answer

Set the 'scope' parameter to 'new'.

Answer

Set the 'scope' parameter to 'all'.

Answer

Pass the container ID to the child playbook.

Question 2

A custom function in a Splunk SOAR playbook is designed to parse a complex, nested JSON object from an API response. The developer needs to extract a specific value located at `results[0].indicators.domains[2].name`. Which is the most robust datapath to access this value?

Accepted Answer

results[0].indicators.domains[2].name

Answer

results.0.indicators.domains.2.name

Answer

results:0:indicators:domains:2:name

Answer

results.*.indicators.domains.*.name

Question 3

A developer needs to write a custom function that enriches multiple artifacts and then adds a single, consolidated note to the container. Which TWO of the following `phantom` library calls are essential for this task? (Select TWO)

Accepted Answer

phantom.act()

Accepted Answer

phantom.add_note()

Answer

phantom.prompt()

Answer

phantom.get_container()

Answer

phantom.set_severity()

Question 4

True or False: When a playbook uses a 'Manual Task' block, the entire playbook execution pauses and enters a 'pending' state until a user manually marks the task as complete.

Accepted Answer

True

Answer

False

Question 5

A financial institution is using Splunk SOAR to automate responses to phishing alerts originating from Splunk Enterprise Security (ES). They need to ensure that when a notable event from ES creates a container in SOAR, the original notable event's urgency is mapped to the SOAR container's severity. Where is this mapping configured?

Accepted Answer

In the asset configuration settings for the Splunk App for SOAR Export on the Splunk search head.

Answer

In the playbook that triggers on ingestion.

Answer

In the Splunk Enterprise Security Content Management settings.

Answer

In the Splunk SOAR global settings under 'Event Settings'.

Question 6

**Case Study:** A managed security service provider (MSSP) uses a single Splunk SOAR instance to serve multiple tenants. They have developed a standardized 'Threat Intel Enrichment' playbook that is used by all tenants. Recently, a new premium tenant requires a slightly different enrichment process that involves an additional, proprietary threat intelligence source. The MSSP wants to avoid duplicating the entire playbook for one minor change. The current playbook structure is a single, monolithic playbook. The MSSP wants to re-architect the solution to be more modular and maintainable. They need to create a solution where the core enrichment logic is shared, but the premium tenant's workflow includes the extra step. All tenants should use the same initial trigger. Which approach best meets the MSSP's requirements for modularity and minimal duplication?

Accepted Answer

Refactor the playbook into a parent and child structure. The parent playbook runs for all tenants, calls a 'Core Enrichment' child playbook, and then uses a decision block based on the tenant label to conditionally call a second 'Premium Enrichment' child playbook.

Answer

Clone the existing playbook, add the new action for the premium tenant, and assign it to that tenant's label.

Answer

Modify the original playbook to include a decision block that checks the tenant's name and runs the proprietary enrichment action only for the premium tenant.

Answer

Create two parent playbooks, one for standard tenants and one for the premium tenant, both of which call the same child playbook containing the core enrichment logic.

Question 7

A developer is building a playbook that queries a custom list containing network CIDR ranges and their corresponding business units. The playbook receives an IP address as an artifact and must find the correct business unit. The custom list is named `business_unit_cidrs`. Which block is best suited to perform this lookup directly within the visual playbook editor?

Accepted Answer

A Utility block with the 'cidr lookup' operation.

Answer

A Filter block comparing the artifact IP to the list.

Answer

An Action block using the 'http' app to query the SOAR API.

Answer

A Custom Function block with Python code to iterate through the list.

Question 8

A SOAR administrator is tasked with retrieving all containers with a 'High' severity that were created in the last 7 days using the REST API. Which Django-style filter query should be used with the `/rest/container` endpoint?

Accepted Answer

?_filter_severity__name='High'&_filter_create_time__gte='now-7d/d'

Answer

?_filter_severity='High' AND _filter_create_time__gte='-7d'

Answer

?_filter_severity='High'&_filter_create_time__range=['now-7d','now']

Answer

?_filter="severity='High' and create_time > '7 days ago'"

Question 9

A developer notices that a playbook designed to block an IP address fails intermittently. The playbook uses two parallel action blocks to add the IP to two different firewalls. The playbook then proceeds to a single 'add note' block. The developer suspects a race condition. The following diagram shows the playbook flow. What is the most effective way to ensure both firewall blocks complete before the note is added?

graph TD A[Start] --> B{Get IP Artifact}; B --> C[Block IP on FW1]; B --> D[Block IP on FW2]; C --> E[Add Note]; D --> E;

Accepted Answer

Insert a 'Join' block before the 'Add Note' block and connect both firewall blocks to it.

Answer

Add a 'Delay' block before the 'Add Note' block.

Answer

Place the two firewall 'Action' blocks in sequence instead of in parallel.

Answer

Use a 'Decision' block after each firewall block to check for success.

Question 10

When should a developer choose to use a Custom Function block over a series of native Visual Playbook Editor (VPE) blocks?

Accepted Answer

When performing complex data manipulation, custom API integrations, or logic that is difficult to represent visually.

Answer

When the playbook needs to call another playbook.

Answer

Any time a playbook needs to run more than three actions in a row.

Answer

When user input is required during playbook execution.

Splunk Soar Certified Automation Developer Free Sample Questions

Lifetime One

Two

Pro Four

Premium Twelve

SPLK-2003 Sample Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Trusted by professionals at