SPLK-2003 Exam Questions

How is a Django filter query performed?

Which of the following is an asset ingestion setting in SOAR?

When configuring a Splunk asset for SOAR to connect to a Splunk Cloud instance, the user discovers that they need to be able to run two different on_poll searches. How is this poss...

What is the primary objective of using the I2A2 playbook design methodology?

Which of the following is a reason to create a new role in SOAR?

Which two playbook blocks can discern which path in the playbook to take next?

Configuring SOAR search to use an external Splunk server provides which of the following benefits?

Where can the Splunk App for SOAR Export be downloaded from?

When writing a custom function that uses regex to extract the domain name from a URL, a user wants to create a new artifact for the extracted domain. Which of the following Python...

In a playbook, more than one Action block can be active at one time. What is this called?

Under Asset Ingestion Settings, how many labels must be applied when configuring an asset?

Which of the following can be done with the System Health Display?

What metrics can be seen from the System Health Display? (select all that apply)

When the Splunk App for SOAR Export executes a Splunk search, which activities are completed?

The SOAR server has been configured to use an external Splunk search head for search and searching on SOAR works; however, the search results don't include content that was being r...

Which of the following is an advantage of using the Visual Playbook Editor?

A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes. What...

Where in SOAR can a user view the JSON data for a container?

When assigning an input parameter to an action while building a playbook, a user notices the artifact value they are looking for does not appear in the auto-populated list. How is...

Which of the following actions will store a compressed, secure version of an email attachment with suspected malware for future analysis?

Without customizing container status within SOAR, what are the three types of status for a container?

Which of the following are the default ports that must be configured on Splunk to allow connections from SOAR?

What users are included in a new installation of SOAR?

A user selects the New option under Sources on the menu. What will be displayed?