SPLK-2003 · Question #10
SPLK-2003 Question #10: Real Exam Question with Answer & Explanation
The correct answer is C. With the > action button in the Investigation page.. An individual asset action can be manually started with the > action button in the Investigation page. This allows the user to select an asset and an action to perform on it. The other options are not valid ways to start an asset action manually. See Performing asset actions for
Question
Options
- AWith the > action button in the analyst queue page.
- BBy executing a playbook in the Playbooks section.
- CWith the > action button in the Investigation page.
- DWith the > asset button in the asset configuration section.
Explanation
An individual asset action can be manually started with the > action button in the Investigation page. This allows the user to select an asset and an action to perform on it. The other options are not valid ways to start an asset action manually. See Performing asset actions for more information. Individual asset actions in Splunk SOAR can be manually initiated from the Investigation page of a container. The "> action" button on this page allows users to execute specific actions associated with assets directly, enabling on-the-fly operations on artifacts or indicators within a container. This feature is particularly useful for ad-hoc analysis and actions, allowing analysts to respond to or investigate specific aspects of an incident without the need for a full playbook.
Community Discussion
No community discussion yet for this question.