Splunk
SPLK-2003 · Question #62
Two action blocks, geolocate_ip_1 and file_reputation_2, are connected to a decision block. Which of the following is a correct configuration for making a decision on the action results from one of th
Sign in or unlock SPLK-2003 to reveal the answer and full explanation for question #62. The question stem and answer options stay visible for context.
Developing Playbooks
Question
Two action blocks, geolocate_ip_1 and file_reputation_2, are connected to a decision block. Which of the following is a correct configuration for making a decision on the action results from one of the given blocks?
Options
- ASelect parameter set to: file_reputation_2:action_result.data.*.response_code; evaluation option
- BSelect parameter set to: geolocate_ip_1:action_result.data.*.country_iso_code; evaluation option
- CSelect parameter set to: geolocate_ip_1:action_result.cef.*.country_iso_code; evaluation option
- DSelect parameter set to: file_reputation_2:action_result.cef.*.response_code; evaluation option
Unlock SPLK-2003 to see the answer
You've previewed enough free SPLK-2003 questions. Unlock SPLK-2003 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#decision block#action_result data path#playbook blocks#data path syntax