Splunk SOAR Automation Developer (SPLK-2003) Certification Sample Questions

02. A developer needs a playbook to look up an address's reputation and branch on the verdict. The installed threat-intelligence app already provides a reputation action for that service, and the developer proposes writing the lookup in a code block instead, on the grounds that they find code quicker to write.
What is wrong with that choice?
a) Nothing is wrong, provided the code block is placed after a filter so that only the addresses needing a verdict reach it.
b) The verdict a code block produces cannot be read by a decision block, so the branch could not be built on it.
c) The app's action already provides the capability, and code written to replace it becomes a piece the team maintains itself when the service changes.
d) Code blocks are not permitted to issue requests to a service outside the platform, so a lookup written that way would never reach the threat-intelligence provider.

03. A ticketing platform adds notes to Splunk SOAR events through the REST API, authenticating as an account created for that integration. An analyst opening one of those events afterwards asks where the note came from. Which two statements are correct?
(Choose two.)
a) The note sits on the event exactly as one added in the interface would, so the analyst reads it with the rest of the event's record.
b) The note is held separately from the event's own record and is retrieved only through the REST API that wrote it.
c) It is recorded against whichever analyst owns the event at the time, since a REST call has no identity of its own.
d) It is recorded against the account the integration authenticated as, which is why an integration is better given an account of its own.

04. Three playbooks call one child playbook that enriches a user account, and a developer is about to change what the child returns. What follows from making that change?
a) The change applies only to those parents running against the same label as the child, with a child playbook scoped by the label of the events its callers work on.
b) Each parent holds a copy of the child taken when the call was first configured, so the change reaches a parent only once its call has been reconfigured.
c) All three parents pick it up at their next run, so what the child returns is a contract they depend on.
d) Parents already part-way through a run switch to the new version at their next block, so a run in progress can finish with a mixture of the two versions.

05. A SOC keeps a set of approved bulk-mail senders that several playbooks consult, and wants each entry to carry the sender's domain together with the handling that sender calls for. What does a custom list allow here?
a) A list is a table of rows and columns, so an entry can hold the domain and its handling side by side.
b) A list holds one value in each row, so anything beyond the domain itself has to be recorded on the container instead of in the list.
c) Each row in a list carries a declared type, so the platform decides how an entry is compared whenever a playbook reads the list.
d) A list holds a key and a value in each row, so a third piece of information about a sender needs a second list keyed the same way.

06. A script queries the SOAR REST API for the containers carrying a particular label, using a Django-style filter, and records a failure whenever it gets no records back. The team finds it recording failures on quiet days when nothing carrying that label was raised.
What should the script be told to expect?
a) A refused call, since the account is not permitted to read a resource with no matching records.
b) An error from the platform, because a filter naming a value that no container currently carries cannot be evaluated.
c) A successful call returning no records, since a filter that matches nothing is an ordinary result rather than an error.
d) A successful call returning every container on the platform, since a filter that matches nothing is ignored and the whole resource comes back.

07. A developer is writing a code block that reads a risk score out of an enrichment action's result and hands it to the blocks that follow. Which two have to be accounted for?
(Choose two.)
a) The datapath the code reads may resolve to nothing on a given run, the block is handed nothing rather than an error, and the code has to cope with the value being absent.
b) The code has to declare the action it depends on as a prerequisite, or the platform will run the two blocks in an undefined order.
c) The code has to be written against a sample structure typed by hand, because a running playbook does not expose what a block received, what it returned, or how long it took.
d) A value the later blocks need has to be returned as an output of the block, since anything held only inside the code is not addressable by a datapath.

08. A SOC already receives Enterprise Security notables in Splunk SOAR. It now wants the playbooks its automation team owns to run searches against the Splunk indexes and branch on what comes back, and none of that works yet. Which two have to be arranged?
(Choose two.)
a) The Splunk App for SOAR Export is configured with a second destination, so the one channel carries the notables in, the searches out, and the results back again.
b) The roles held by whatever the playbooks run as are permitted to use that asset.
c) The Splunk app is installed in SOAR and an asset is configured for it, holding the Splunk deployment's address and the credentials the search will use.
d) Externalized search is enabled on the SOAR instance, since a playbook can only reach a Splunk deployment that SOAR's own search already points at.

09. The Splunk App for SOAR Export has been installed on a Splunk deployment so that Enterprise Security notables reach the organization's Splunk SOAR platform. A SOAR administrator is asked what has to be prepared on the SOAR side. What does the app on the Splunk deployment need from SOAR?
a) An account on SOAR to authenticate as, carrying the roles needed to create the containers the notables become.
b) A data ingestion asset for Enterprise Security, which polls the Splunk deployment for new notables.
c) Nothing, since a notable delivered from Splunk is written in without passing through any account.
d) A playbook set active for the notable label, because the app can only deliver a notable that an active playbook is waiting to receive.

10. A SOC already runs Splunk Enterprise Security, where correlation searches raise notables and analysts review them. It is now sending those notables to Splunk SOAR as events. What does sending them to SOAR add?
a) Correlation searches run more quickly, since the work of raising a notable is handed to SOAR.
b) Analysts review the notable in SOAR instead of in Enterprise Security, since a notable that has been sent is closed on the Splunk side.
c) Detection is improved, because the notable is evaluated a second time against SOAR's own correlation rules before an analyst is asked to look at it.
d) The notable becomes an event that playbooks work, so enrichment and containment run through SOAR's apps and assets.