Splunk SPLK-2003 Practice Exams
Last updated on Oct 06,2026- Exam Code: SPLK-2003
- Exam Name: Splunk SOAR Certified Automation Developer Exam
- Certification Provider: Splunk
- Latest update: Oct 06,2026
Question #1
A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes.
What is the cause of this behavior?
- A . Incorrect Join configuration on the second playbook.
- B . The first playbook is performing poorly.
- C . The steep option for the second playbook is not set to a long enough interval.
- D . Synchronous execution has not been configured.
Correct Answer: D
D
Explanation:
The correct answer is D because synchronous execution has not been configured. Synchronous execution is a feature that allows you to control the order of execution of playbook blocks. By default, Phantom executes playbook blocks asynchronously, meaning that it does not wait for one block to finish before starting the next one. This can cause problems when you have dependencies between blocks or when you call other playbooks. To enable synchronous execution, you need to use the sync action in the run playbook block and specify the name of the next block to run after the called playbook completes. See Splunk SOAR Documentation for more details.
In Splunk SOAR, playbooks can be executed either synchronously or asynchronously. Synchronous execution ensures that a playbook waits for a called playbook to complete before proceeding to the next step. If the second playbook starts executing before the first one completes, it indicates that synchronous execution was not configured for the playbooks. Without synchronous execution, playbooks will execute independently of each other’s completion status, leading to potential overlaps in execution. This behavior can be controlled by properly configuring the playbook execution settings to ensure that dependent playbooks complete their tasks in the desired order.
D
Explanation:
The correct answer is D because synchronous execution has not been configured. Synchronous execution is a feature that allows you to control the order of execution of playbook blocks. By default, Phantom executes playbook blocks asynchronously, meaning that it does not wait for one block to finish before starting the next one. This can cause problems when you have dependencies between blocks or when you call other playbooks. To enable synchronous execution, you need to use the sync action in the run playbook block and specify the name of the next block to run after the called playbook completes. See Splunk SOAR Documentation for more details.
In Splunk SOAR, playbooks can be executed either synchronously or asynchronously. Synchronous execution ensures that a playbook waits for a called playbook to complete before proceeding to the next step. If the second playbook starts executing before the first one completes, it indicates that synchronous execution was not configured for the playbooks. Without synchronous execution, playbooks will execute independently of each other’s completion status, leading to potential overlaps in execution. This behavior can be controlled by properly configuring the playbook execution settings to ensure that dependent playbooks complete their tasks in the desired order.
Question #2
What is the simplest way to pass data between playbooks?
- A . Action results
- B . File system
- C . Artifacts
- D . KV Store
Correct Answer: C
C
Explanation:
The simplest way to pass data between playbooks in Splunk SOAR is through the use of artifacts. Artifacts are objects that can store data and are associated with containers. When multiple playbooks work on a single container, they can access and manipulate the same set of artifacts, allowing for seamless data transfer between playbooks. This method is straightforward and does not require additional setup or management of external storage systems, making it the most direct and efficient way to pass data within the Splunk SOAR environment1.
Reference: Passing data between SOAR playbooks – Splunk Lantern
C
Explanation:
The simplest way to pass data between playbooks in Splunk SOAR is through the use of artifacts. Artifacts are objects that can store data and are associated with containers. When multiple playbooks work on a single container, they can access and manipulate the same set of artifacts, allowing for seamless data transfer between playbooks. This method is straightforward and does not require additional setup or management of external storage systems, making it the most direct and efficient way to pass data within the Splunk SOAR environment1.
Reference: Passing data between SOAR playbooks – Splunk Lantern
Question #3
Which of the following expressions will output debug information to the debug window in the Visual Playbook Editor?
- A . phantom.debug()
- B . phantom.exception()
- C . phantom.print ()
- D . phantom.assert()
Correct Answer: A
A
Explanation:
The phantom.debug() function is used within Splunk SOAR playbooks to output debug information to the debug window in the Visual Playbook Editor. This function is instrumental in troubleshooting and developing playbooks, as it allows developers to print out variables, messages, or any relevant information that can help in understanding the flow of the playbook, the data being processed, and any issues that might arise during execution. This debugging tool is essential for ensuring that playbooks are functioning as intended and for diagnosing any problems that may occur.
A
Explanation:
The phantom.debug() function is used within Splunk SOAR playbooks to output debug information to the debug window in the Visual Playbook Editor. This function is instrumental in troubleshooting and developing playbooks, as it allows developers to print out variables, messages, or any relevant information that can help in understanding the flow of the playbook, the data being processed, and any issues that might arise during execution. This debugging tool is essential for ensuring that playbooks are functioning as intended and for diagnosing any problems that may occur.
Question #4
A customer wants to design a modular and reusable set of playbooks that all communicate with each other.
Which of the following is a best practice for data sharing across playbooks?
- A . Use the py-postgresq1 module to directly save the data in the Postgres database.
- B . Cal the child playbooks getter function.
- C . Create artifacts using one playbook and collect those artifacts in another playbook.
- D . Use the Handle method to pass data directly between playbooks.
Correct Answer: C
C
Explanation:
The correct answer is C because creating artifacts using one playbook and collecting those artifacts in another playbook is a best practice for data sharing across playbooks. Artifacts are data objects that are associated with a container and can be used to store information such as IP addresses, URLs, file hashes, etc. Artifacts can be created using the add artifact action in any playbook block and can be collected using the get artifacts action in the filter block. Artifacts can also be used to trigger active playbooks based on their label or type. See Splunk SOAR Documentation for more details.
In the context of Splunk SOAR, one of the best practices for data sharing across playbooks is to create artifacts in one playbook and use another playbook to collect and utilize those artifacts. Artifacts in Splunk SOAR are structured data related to security incidents (containers) that playbooks can act upon. By creating artifacts in one playbook, you can effectively pass data and context to subsequent playbooks, allowing for modular, reusable, and interconnected playbook designs. This approach promotes efficiency, reduces redundancy, and enhances the playbook’s ability to handle complex workflows.
C
Explanation:
The correct answer is C because creating artifacts using one playbook and collecting those artifacts in another playbook is a best practice for data sharing across playbooks. Artifacts are data objects that are associated with a container and can be used to store information such as IP addresses, URLs, file hashes, etc. Artifacts can be created using the add artifact action in any playbook block and can be collected using the get artifacts action in the filter block. Artifacts can also be used to trigger active playbooks based on their label or type. See Splunk SOAR Documentation for more details.
In the context of Splunk SOAR, one of the best practices for data sharing across playbooks is to create artifacts in one playbook and use another playbook to collect and utilize those artifacts. Artifacts in Splunk SOAR are structured data related to security incidents (containers) that playbooks can act upon. By creating artifacts in one playbook, you can effectively pass data and context to subsequent playbooks, allowing for modular, reusable, and interconnected playbook designs. This approach promotes efficiency, reduces redundancy, and enhances the playbook’s ability to handle complex workflows.
Question #5
How can a user with the username "pat" configure the Analyst Queue to only show new events that are assigned to the current user?
- A . Create a filter for label-new and owner-pat.
- B . Create a filter for status-open and owner-pat.
- C . Create a filter for status=new and owner=pat.
- D . Create a filter for status=new or owner=pat.
Correct Answer: C
C
Explanation:
To configure the Analyst Queue to only show new events that are assigned to the current user "pat", the correct filter would involve two conditions:
status=new: This ensures that only new events are displayed.
owner=pat: This ensures that the displayed events are specifically assigned to the user "pat."
By applying both of these filters, the user will only see events that are both in the "new" status and assigned to them. The other options, such as filtering for "label" or using "or" in the filter, would either result in showing incorrect data or broader results that are not restricted to new events assigned to the user.
Reference: Splunk SOAR Documentation: Analyst Queue Filters.
Splunk SOAR User Guide for Customizing Event Views.
C
Explanation:
To configure the Analyst Queue to only show new events that are assigned to the current user "pat", the correct filter would involve two conditions:
status=new: This ensures that only new events are displayed.
owner=pat: This ensures that the displayed events are specifically assigned to the user "pat."
By applying both of these filters, the user will only see events that are both in the "new" status and assigned to them. The other options, such as filtering for "label" or using "or" in the filter, would either result in showing incorrect data or broader results that are not restricted to new events assigned to the user.
Reference: Splunk SOAR Documentation: Analyst Queue Filters.
Splunk SOAR User Guide for Customizing Event Views.
Question #6
Which is the primary system requirement that should be increased with heavy usage of the file vault?
- A . Amount of memory.
- B . Number of processors.
- C . Amount of storage.
- D . Bandwidth of network.
Correct Answer: C
C
Explanation:
The primary system requirement that should be increased with heavy usage of the file vault is the amount of storage. The file vault is a secure repository for storing files on Phantom. The more files are stored, the more storage space is needed. The other options are not directly related to the file vault usage. See [File vault] for more information.
Heavy usage of the file vault in Splunk SOAR necessitates an increase in the amount of storage available. The file vault is used to securely store files associated with cases, such as malware samples, logs, and other artifacts relevant to an investigation. As the volume of files and the size of stored data grow, ensuring sufficient storage capacity becomes critical to maintain performance and ensure that all necessary data is retained for analysis and evidence.
C
Explanation:
The primary system requirement that should be increased with heavy usage of the file vault is the amount of storage. The file vault is a secure repository for storing files on Phantom. The more files are stored, the more storage space is needed. The other options are not directly related to the file vault usage. See [File vault] for more information.
Heavy usage of the file vault in Splunk SOAR necessitates an increase in the amount of storage available. The file vault is used to securely store files associated with cases, such as malware samples, logs, and other artifacts relevant to an investigation. As the volume of files and the size of stored data grow, ensuring sufficient storage capacity becomes critical to maintain performance and ensure that all necessary data is retained for analysis and evidence.
Question #7
A user selects the New option under Sources on the menu.
What will be displayed?
- A . A list of new assets.
- B . The New Data Ingestion wizard.
- C . A list of new data sources.
- D . A list of new events.
Correct Answer: B
B
Explanation:
Selecting the New option under Sources in the Splunk SOAR menu typically initiates the New Data Ingestion wizard. This wizard guides users through the process of configuring new data sources for ingestion into the SOAR platform. It is designed to streamline the setup of various data inputs, such as event logs, threat intelligence feeds, or notifications from other security tools, ensuring that SOAR can receive and process relevant security data efficiently. This feature is crucial for expanding SOAR’s
monitoring and response capabilities by integrating diverse data sources.
Options A, C, and D do not accurately describe what is displayed when the New option under Sources is selected, making option B the correct choice.
New Data Ingestion wizard allows you to create a new data source for Splunk SOAR (On-premises) by selecting the type of data, the ingestion method, and the configuration options. The other options are incorrect because they do not match the description of the New option under Sources on the menu. For example, option A refers to a list of new assets, which is not related to data ingestion.
Option C refers to a list of new data sources, which is not what the New option does.
Option D refers to a list of new events, which is not the same as creating a new data source.
B
Explanation:
Selecting the New option under Sources in the Splunk SOAR menu typically initiates the New Data Ingestion wizard. This wizard guides users through the process of configuring new data sources for ingestion into the SOAR platform. It is designed to streamline the setup of various data inputs, such as event logs, threat intelligence feeds, or notifications from other security tools, ensuring that SOAR can receive and process relevant security data efficiently. This feature is crucial for expanding SOAR’s
monitoring and response capabilities by integrating diverse data sources.
Options A, C, and D do not accurately describe what is displayed when the New option under Sources is selected, making option B the correct choice.
New Data Ingestion wizard allows you to create a new data source for Splunk SOAR (On-premises) by selecting the type of data, the ingestion method, and the configuration options. The other options are incorrect because they do not match the description of the New option under Sources on the menu. For example, option A refers to a list of new assets, which is not related to data ingestion.
Option C refers to a list of new data sources, which is not what the New option does.
Option D refers to a list of new events, which is not the same as creating a new data source.
Question #8
Which of the following can be configured in the ROl Settings?
- A . Analyst hours per month.
- B . Time lost.
- C . Number of full time employees (FTEs).
- D . Annual analyst salary.
Correct Answer: C
C
Explanation:
The ROI (Return on Investment) Settings within Splunk SOAR are designed to help organizations
assess the value derived from their use of the platform, particularly in terms of resource allocation and efficiency gains. The setting mentioned in the question, "Number of full time employees (FTEs)," relates directly to measuring this efficiency.
Answer "C" is correct because configuring the number of full-time employees (FTEs) in the ROI settings allows an organization to input and monitor how many personnel are dedicated to security operations managed through SOAR. This setting is crucial for calculating the labor cost associated with incident response and routine security tasks. By understanding the number of FTEs involved, organizations can better assess the labor cost savings provided by automation and orchestration in SOAR. This data helps in quantifying the operational efficiency and the overall impact of SOAR on resource optimization.
In contrast, other options like "Analyst hours per month," "Time lost," and "Annual analyst salary" might seem relevant but are not directly configurable within the ROI settings of Splunk SOAR. These aspects could be indirectly calculated or estimated based on the number of FTEs and other operational metrics but are not directly input as settings in the system.
This use of FTEs in ROI calculations is often discussed in materials related to cybersecurity efficiency metrics and SOAR platform utilization. Official Splunk documentation and best practices guides typically provide insights into how to set up and interpret ROI settings, highlighting the importance of accurate configuration for meaningful analytics.
C
Explanation:
The ROI (Return on Investment) Settings within Splunk SOAR are designed to help organizations
assess the value derived from their use of the platform, particularly in terms of resource allocation and efficiency gains. The setting mentioned in the question, "Number of full time employees (FTEs)," relates directly to measuring this efficiency.
Answer "C" is correct because configuring the number of full-time employees (FTEs) in the ROI settings allows an organization to input and monitor how many personnel are dedicated to security operations managed through SOAR. This setting is crucial for calculating the labor cost associated with incident response and routine security tasks. By understanding the number of FTEs involved, organizations can better assess the labor cost savings provided by automation and orchestration in SOAR. This data helps in quantifying the operational efficiency and the overall impact of SOAR on resource optimization.
In contrast, other options like "Analyst hours per month," "Time lost," and "Annual analyst salary" might seem relevant but are not directly configurable within the ROI settings of Splunk SOAR. These aspects could be indirectly calculated or estimated based on the number of FTEs and other operational metrics but are not directly input as settings in the system.
This use of FTEs in ROI calculations is often discussed in materials related to cybersecurity efficiency metrics and SOAR platform utilization. Official Splunk documentation and best practices guides typically provide insights into how to set up and interpret ROI settings, highlighting the importance of accurate configuration for meaningful analytics.
Question #9
Which of the following supported approaches enables Phantom to run on a Windows server?
- A . Install the Phantom RPM in a GNU Cygwin implementation.
- B . Run the Phantom OVA as a cloud instance.
- C . Install the Phantom RPM file in Windows Subsystem for Linux (WSL).
- D . Run the Phantom OVA as a virtual machine.
Correct Answer: D
D
Explanation:
Splunk SOAR (formerly Phantom) does not natively run on Windows servers as it is primarily designed for Linux environments. However, it can be deployed on a Windows server through virtualization. By running the Phantom OVA (Open Virtualization Appliance) as a virtual machine, users can utilize virtualization platforms like VMware or VirtualBox on a Windows server to host the Phantom environment. This approach allows for the deployment of Phantom in a Windows-centric infrastructure by leveraging virtualization technology to encapsulate the Phantom application within a supported Linux environment provided by the OVA.
D
Explanation:
Splunk SOAR (formerly Phantom) does not natively run on Windows servers as it is primarily designed for Linux environments. However, it can be deployed on a Windows server through virtualization. By running the Phantom OVA (Open Virtualization Appliance) as a virtual machine, users can utilize virtualization platforms like VMware or VirtualBox on a Windows server to host the Phantom environment. This approach allows for the deployment of Phantom in a Windows-centric infrastructure by leveraging virtualization technology to encapsulate the Phantom application within a supported Linux environment provided by the OVA.
Question #10
Which of the following will show all artifacts that have the term results in a filePath CEF value?
- A . …/rest/artifact?_filter_cef_filePath_icontain=”results”
- B . …rest/artifacts/filePath=”%results%”
- C . …/result/artifacts/cef/filePath= ‘%results%”
- D . …/result/artifact?_query_cef_filepath_icontains=”results
Correct Answer: A
A
Explanation:
The correct answer is A because the _filter parameter is used to filter the results based on a field value, and the icontain operator is used to perform a case-insensitive substring match.
The filePath field is part of the Common Event Format (CEF) standard, and the cef_ prefix is used to access CEF fields in the REST API. The answer B is incorrect because it uses the wrong syntax for the REST API. The answer C is incorrect because it uses the wrong endpoint (result instead of artifact) and the wrong syntax for the REST API. The answer D is incorrect because it uses the wrong syntax for the REST API and the wrong spelling for the icontains operator.
Reference: Splunk SOAR REST API Guide, page 18.
To query and display all artifacts that contain the term "results" in a filePath CEF (Common Event Format) value, using the REST API endpoint with a filter parameter is effective. The filter _filter_cef_filePath_icontain="results" is applied to search within the artifact data for filePath fields that contain the term "results", disregarding case sensitivity. This method allows users to precisely locate and work with artifacts that meet specific criteria, aiding in the investigation and analysis processes within Splunk SOAR.
A
Explanation:
The correct answer is A because the _filter parameter is used to filter the results based on a field value, and the icontain operator is used to perform a case-insensitive substring match.
The filePath field is part of the Common Event Format (CEF) standard, and the cef_ prefix is used to access CEF fields in the REST API. The answer B is incorrect because it uses the wrong syntax for the REST API. The answer C is incorrect because it uses the wrong endpoint (result instead of artifact) and the wrong syntax for the REST API. The answer D is incorrect because it uses the wrong syntax for the REST API and the wrong spelling for the icontains operator.
Reference: Splunk SOAR REST API Guide, page 18.
To query and display all artifacts that contain the term "results" in a filePath CEF (Common Event Format) value, using the REST API endpoint with a filter parameter is effective. The filter _filter_cef_filePath_icontain="results" is applied to search within the artifact data for filePath fields that contain the term "results", disregarding case sensitivity. This method allows users to precisely locate and work with artifacts that meet specific criteria, aiding in the investigation and analysis processes within Splunk SOAR.