Splunk SPLK-2003 Practice Exams
Last updated on Oct 07,2026- Exam Code: SPLK-2003
- Exam Name: Splunk SOAR Certified Automation Developer Exam
- Certification Provider: Splunk
- Latest update: Oct 07,2026
Question #91
Without customizing container status within Phantom, what are the three types of status for a container?
- A . New, In Progress, Closed
- B . Low, Medium, High
- C . Mew, Open, Resolved
- D . Low, Medium, Critical
Correct Answer: A
A
Explanation:
Within Splunk SOAR, containers (which represent incidents, cases, or events) have a lifecycle that is tracked through their status. The default statuses available without any customization are "New", "In Progress", and "Closed". These statuses help in organizing and managing the incident response process, allowing users to easily track the progress of investigations and responses from initial detection through to resolution.
A
Explanation:
Within Splunk SOAR, containers (which represent incidents, cases, or events) have a lifecycle that is tracked through their status. The default statuses available without any customization are "New", "In Progress", and "Closed". These statuses help in organizing and managing the incident response process, allowing users to easily track the progress of investigations and responses from initial detection through to resolution.
Question #92
Seventy can be set during ingestion and later changed manually.
What other mechanism can change the severity or a container?
- A . Notes
- B . Actions
- C . Service level agreement (SLA) expiration
- D . Playbooks
Correct Answer: D
D
Explanation:
The severity of a container in Splunk Phantom can be set manually or automatically during the ingestion process. In addition to these methods, playbooks can also change the severity of a container. Playbooks are automated workflows that define a series of actions based on certain triggers and conditions. Within a playbook, actions can be defined to adjust the severity level of a container depending on the analysis of the event data, the outcome of actions taken, or other contextual factors. This dynamic adjustment allows for a more accurate and responsive incident prioritization as new information becomes available during the investigation process.
D
Explanation:
The severity of a container in Splunk Phantom can be set manually or automatically during the ingestion process. In addition to these methods, playbooks can also change the severity of a container. Playbooks are automated workflows that define a series of actions based on certain triggers and conditions. Within a playbook, actions can be defined to adjust the severity level of a container depending on the analysis of the event data, the outcome of actions taken, or other contextual factors. This dynamic adjustment allows for a more accurate and responsive incident prioritization as new information becomes available during the investigation process.
Question #93
What is the primary objective of using the I2A2 playbook design methodology?
- A . To create detailed playbooks.
- B . To create playbooks that customers will not edit.
- C . To meet customer requirements using a single playbook.
- D . To create simple, reusable, modular playbooks.
Correct Answer: D
D
Explanation:
The primary objective of using the I2A2 playbook design methodology in Splunk SOAR is to create playbooks that are simple, reusable, and modular. This design philosophy emphasizes the creation of playbooks that can be easily understood and maintained, encourages the reuse of playbook components in different scenarios, and fosters the development of playbooks that can be modularly connected or used independently as needed.
I2A2 design methodology is a framework for designing playbooks that consists of four components:
• Inputs: The data that is required for the playbook to run, such as artifacts, parameters, or custom fields.
• Interactions: The blocks that allow the playbook to communicate with users or other systems, such as prompts, comments, or emails.
• Actions: The blocks that execute the core logic of the playbook, such as app actions, filters, decisions, or utilities.
• Artifacts: The data that is generated or modified by the playbook, such as new artifacts, container fields, or notes.
The I2A2 design methodology helps you to plan, structure, and test your playbooks in a modular and efficient way. The primary objective of using the I2A2 design methodology is to create simple, reusable, modular playbooks that can be easily maintained, shared, and customized. Therefore, option D is the correct answer, as it states the primary objective of using the I2A2 design methodology.
Option A is incorrect, because creating detailed playbooks is not the primary objective of using the I2A2 design methodology, but rather a possible outcome of following the framework.
Option B is incorrect, because creating playbooks that customers will not edit is not the primary objective of using the I2A2 design methodology, but rather a potential risk of not following the framework.
Option C is incorrect, because meeting customer requirements using a single playbook is not the primary objective of using the I2A2 design methodology, but rather a challenge that can be overcome by using the framework.
1: Use a playbook design methodology in Administer Splunk SOAR (Cloud).
D
Explanation:
The primary objective of using the I2A2 playbook design methodology in Splunk SOAR is to create playbooks that are simple, reusable, and modular. This design philosophy emphasizes the creation of playbooks that can be easily understood and maintained, encourages the reuse of playbook components in different scenarios, and fosters the development of playbooks that can be modularly connected or used independently as needed.
I2A2 design methodology is a framework for designing playbooks that consists of four components:
• Inputs: The data that is required for the playbook to run, such as artifacts, parameters, or custom fields.
• Interactions: The blocks that allow the playbook to communicate with users or other systems, such as prompts, comments, or emails.
• Actions: The blocks that execute the core logic of the playbook, such as app actions, filters, decisions, or utilities.
• Artifacts: The data that is generated or modified by the playbook, such as new artifacts, container fields, or notes.
The I2A2 design methodology helps you to plan, structure, and test your playbooks in a modular and efficient way. The primary objective of using the I2A2 design methodology is to create simple, reusable, modular playbooks that can be easily maintained, shared, and customized. Therefore, option D is the correct answer, as it states the primary objective of using the I2A2 design methodology.
Option A is incorrect, because creating detailed playbooks is not the primary objective of using the I2A2 design methodology, but rather a possible outcome of following the framework.
Option B is incorrect, because creating playbooks that customers will not edit is not the primary objective of using the I2A2 design methodology, but rather a potential risk of not following the framework.
Option C is incorrect, because meeting customer requirements using a single playbook is not the primary objective of using the I2A2 design methodology, but rather a challenge that can be overcome by using the framework.
1: Use a playbook design methodology in Administer Splunk SOAR (Cloud).
Question #94
After a successful POST to a Phantom REST endpoint to create a new object what result is returned?
- A . The new object ID.
- B . The new object name.
- C . The full CEF name.
- D . The PostGres UUID.
Correct Answer: A
A
Explanation:
The correct answer is A because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is the new object ID. The object ID is a unique identifier for each object in Phantom, such as a container, an artifact, an action, or a playbook. The object ID can be used to retrieve, update, or delete the object using the Phantom REST API. The answer B is incorrect because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is not the new object name, which is a human-readable name for the object. The object name can be used to search for the object using the Phantom web interface. The answer C is incorrect because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is not the full CEF name, which is a standard format for event data. The full CEF name can be used to access the CEF fields of an artifact using the Phantom REST API. The answer D is incorrect because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is not the PostGres UUID, which is a unique identifier for each row in a PostGres database. The PostGres UUID is not exposed to the Phantom REST API.
Reference: Splunk SOAR REST API Guide, page 17. When a POST request is made to a Phantom REST endpoint to create a new object, such as an event, artifact, or container, the typical response includes the ID of the newly created object. This ID is a unique identifier that can be used to reference the object within the system for future operations, such as updating, querying, or deleting the object. The response does not usually include the full name or other specific details of the object, as the ID is the most important piece of information needed immediately after creation for reference purposes.
A
Explanation:
The correct answer is A because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is the new object ID. The object ID is a unique identifier for each object in Phantom, such as a container, an artifact, an action, or a playbook. The object ID can be used to retrieve, update, or delete the object using the Phantom REST API. The answer B is incorrect because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is not the new object name, which is a human-readable name for the object. The object name can be used to search for the object using the Phantom web interface. The answer C is incorrect because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is not the full CEF name, which is a standard format for event data. The full CEF name can be used to access the CEF fields of an artifact using the Phantom REST API. The answer D is incorrect because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is not the PostGres UUID, which is a unique identifier for each row in a PostGres database. The PostGres UUID is not exposed to the Phantom REST API.
Reference: Splunk SOAR REST API Guide, page 17. When a POST request is made to a Phantom REST endpoint to create a new object, such as an event, artifact, or container, the typical response includes the ID of the newly created object. This ID is a unique identifier that can be used to reference the object within the system for future operations, such as updating, querying, or deleting the object. The response does not usually include the full name or other specific details of the object, as the ID is the most important piece of information needed immediately after creation for reference purposes.
Question #95
During a second test of a playbook, a user receives an error that states: ‘an empty parameters list was passed to phantom.act()." What does this indicate?
- A . The container has artifacts not parameters.
- B . The playbook is using an incorrect container.
- C . The playbook debugger’s scope is set to new.
- D . The playbook debugger’s scope is set to all.
Correct Answer: A
A
Explanation:
The error message "an empty parameters list was passed to phantom.act()" typically indicates that the action being called by the playbook does not have the required parameters to execute. This can happen if the playbook expects certain data to be present in the container’s artifacts but finds none. Artifacts in Splunk SOAR (Phantom) are data elements associated with a container (such as an event or alert) that playbooks can act upon. If a playbook action is designed to use data from artifacts as parameters and those artifacts are missing or do not contain the expected data, the playbook cannot execute the action properly, leading to this error.
A
Explanation:
The error message "an empty parameters list was passed to phantom.act()" typically indicates that the action being called by the playbook does not have the required parameters to execute. This can happen if the playbook expects certain data to be present in the container’s artifacts but finds none. Artifacts in Splunk SOAR (Phantom) are data elements associated with a container (such as an event or alert) that playbooks can act upon. If a playbook action is designed to use data from artifacts as parameters and those artifacts are missing or do not contain the expected data, the playbook cannot execute the action properly, leading to this error.
Question #96
Which of the following is the complete list of the types of backups that are supported by Phantom?
- A . Full backups.
- B . Full, delta, and incremental backups.
- C . Full and incremental backups.
- D . Full and delta backups.
Correct Answer: C
C
Explanation:
Splunk Phantom supports different types of backups to safeguard data. Full backups create a complete copy of the current state of the system, while incremental backups only save the changes made since the last backup. This approach allows for efficient use of storage space and faster backups after the initial full backup. Delta backups, which would save changes since the last full or incremental backup, are not a standard part of Phantom’s backup capabilities according to available documentation. Therefore, the complete list of backups supported by Phantom would be Full and Incremental backups.
C
Explanation:
Splunk Phantom supports different types of backups to safeguard data. Full backups create a complete copy of the current state of the system, while incremental backups only save the changes made since the last backup. This approach allows for efficient use of storage space and faster backups after the initial full backup. Delta backups, which would save changes since the last full or incremental backup, are not a standard part of Phantom’s backup capabilities according to available documentation. Therefore, the complete list of backups supported by Phantom would be Full and Incremental backups.
Question #97
Which of the following items cannot be modified once entered into SOAR?
- A . A container.
- B . An artifact.
- C . A comment.
- D . A note.
Correct Answer: B
B
Explanation:
In Splunk SOAR, once an artifact is entered, it cannot be modified. An artifact refers to a piece of data associated with a specific container, such as log files, emails, or other relevant information in an incident. The immutable nature of artifacts ensures the integrity and forensic value of the data. By preventing modification after creation, SOAR maintains a secure and audit-compliant environment, ensuring that data remains trustworthy throughout the incident’s lifecycle. However, containers, comments, and notes can be updated or modified, making artifacts unique in their immutability.
Reference: Splunk SOAR User Guide: Artifacts and Containers.
Splunk SOAR Best Practices for Incident Management.
B
Explanation:
In Splunk SOAR, once an artifact is entered, it cannot be modified. An artifact refers to a piece of data associated with a specific container, such as log files, emails, or other relevant information in an incident. The immutable nature of artifacts ensures the integrity and forensic value of the data. By preventing modification after creation, SOAR maintains a secure and audit-compliant environment, ensuring that data remains trustworthy throughout the incident’s lifecycle. However, containers, comments, and notes can be updated or modified, making artifacts unique in their immutability.
Reference: Splunk SOAR User Guide: Artifacts and Containers.
Splunk SOAR Best Practices for Incident Management.
Question #98
After a playbook has run, where are the results stored?
- A . Splunk Index
- B . Case
- C . Container
- D . Log file
Correct Answer: C
C
Explanation:
The correct answer is C because after a playbook has run, the results are stored in the container that triggered the playbook. The container is a data object that represents an event or a case in Phantom. The container contains information such as the name, the description, the severity, the status, the owner, and the labels of the event or case. The container also contains the artifacts, the action results, the comments, the notes, and the phases and tasks associated with the event or case. The answer A is incorrect because after a playbook has run, the results are not stored in a Splunk index, which is a data structure that stores events from various data sources in Splunk. The Splunk index is not directly accessible by Phantom, but can be queried by Phantom using the Splunk app. The answer B is incorrect because after a playbook has run, the results are not stored in a case, which is a type of container that represents a security incident in Phantom. The case is a subset of the container, and not all containers are cases. The answer D is incorrect because after a playbook has run, the results are not stored in a log file, which is a file that records the activities or events that occur in a system or a process. The log file is not a data object in Phantom, but can be a data source for Phantom.
Reference: Splunk SOAR User Guide, page 19. In Splunk Phantom, after a playbook has been executed, the results of the actions within that playbook are stored in the container associated with the event. A container is a data structure that encapsulates all relevant information and data for an incident or event within Phantom, including action results, artifacts, notes, and more. The container allows users to see a consolidated view of all the data and activity related to a particular event. These results are not stored in the Splunk Index, a separate case, or a log file as their primary storage but may be sent to a Splunk index for further analysis.
C
Explanation:
The correct answer is C because after a playbook has run, the results are stored in the container that triggered the playbook. The container is a data object that represents an event or a case in Phantom. The container contains information such as the name, the description, the severity, the status, the owner, and the labels of the event or case. The container also contains the artifacts, the action results, the comments, the notes, and the phases and tasks associated with the event or case. The answer A is incorrect because after a playbook has run, the results are not stored in a Splunk index, which is a data structure that stores events from various data sources in Splunk. The Splunk index is not directly accessible by Phantom, but can be queried by Phantom using the Splunk app. The answer B is incorrect because after a playbook has run, the results are not stored in a case, which is a type of container that represents a security incident in Phantom. The case is a subset of the container, and not all containers are cases. The answer D is incorrect because after a playbook has run, the results are not stored in a log file, which is a file that records the activities or events that occur in a system or a process. The log file is not a data object in Phantom, but can be a data source for Phantom.
Reference: Splunk SOAR User Guide, page 19. In Splunk Phantom, after a playbook has been executed, the results of the actions within that playbook are stored in the container associated with the event. A container is a data structure that encapsulates all relevant information and data for an incident or event within Phantom, including action results, artifacts, notes, and more. The container allows users to see a consolidated view of all the data and activity related to a particular event. These results are not stored in the Splunk Index, a separate case, or a log file as their primary storage but may be sent to a Splunk index for further analysis.
Question #99
What are the differences between cases and events?
- A . Case: potential threats.
Events: identified as a specific kind of problem and need a structured approach. - B . Cases: only include high-level incident artifacts. Events: only include low-level incident artifacts.
- C . Cases: contain a collection of containers. Events: contain potential threats.
- D . Cases: incidents with a known violation and a plan for correction. Events: occurrences in the system that may require a response.
Correct Answer: C
C
Explanation:
In Splunk SOAR, an event is a security occurrence that may require a response. It is ingested from a third-party source and can be labeled to group related events together. The default label for containers is “Events,” which signifies potential threats13. A case, on the other hand, is a container that holds several containers, consolidating multiple events into one logical management unit. Cases can include artifacts and external evidence such as screen captures, analyst notes, and event data from third-party products22. They are used to manage and analyze investigation data tied to specific security events and incidents, providing a structured approach to incident response34.
Reference: Manage the status, severity, and resolution of events in Splunk SOAR (Cloud) – Splunk Documentation
Managing cases in SOAR – Splunk Lantern
What is Splunk Phantom (Renamed to Splunk SOAR)? – BlueVoyant
Overview of cases – Splunk Documentation
C
Explanation:
In Splunk SOAR, an event is a security occurrence that may require a response. It is ingested from a third-party source and can be labeled to group related events together. The default label for containers is “Events,” which signifies potential threats13. A case, on the other hand, is a container that holds several containers, consolidating multiple events into one logical management unit. Cases can include artifacts and external evidence such as screen captures, analyst notes, and event data from third-party products22. They are used to manage and analyze investigation data tied to specific security events and incidents, providing a structured approach to incident response34.
Reference: Manage the status, severity, and resolution of events in Splunk SOAR (Cloud) – Splunk Documentation
Managing cases in SOAR – Splunk Lantern
What is Splunk Phantom (Renamed to Splunk SOAR)? – BlueVoyant
Overview of cases – Splunk Documentation
Question #100
What is the default embedded search engine used by Phantom?
- A . Embedded Splunk search engine.
- B . Embedded Phantom search engine.
- C . Embedded Elastic search engine.
- D . Embedded Django search engine.
Correct Answer: A
A
Explanation:
The default embedded search engine used by Splunk SOAR (formerly known as Phantom) is the embedded Splunk search engine. Here’s a detailed explanation:
Embedded Splunk Search Engine:
Splunk SOAR uses an embedded, preconfigured version of Splunk Enterprise as its native search engine.
This integration allows for powerful searching capabilities within Splunk SOAR, leveraging Splunk’s robust search and indexing features.
Search Configuration:
While the embedded Splunk search engine is the default, organizations have the option to configure Splunk SOAR to use a different Splunk Enterprise deployment or an external Elasticsearch instance.
This flexibility allows organizations to tailor their search infrastructure to their specific needs and existing environments.
Search Capabilities:
The embedded Splunk search engine enables users to perform complex searches, analyze data, and generate reports directly within the Splunk SOAR platform.
It supports the full range of Splunk’s search processing language (SPL) commands, functions, and visualizations.
Reference: Splunk SOAR Documentation: Configure search in Splunk Phantom1.
Splunk SOAR Documentation: Configure search in Splunk SOAR (On-premises)2.
In summary, the embedded Splunk search engine is the default search engine in Splunk SOAR, providing a seamless and powerful search experience for users within the platform.
A
Explanation:
The default embedded search engine used by Splunk SOAR (formerly known as Phantom) is the embedded Splunk search engine. Here’s a detailed explanation:
Embedded Splunk Search Engine:
Splunk SOAR uses an embedded, preconfigured version of Splunk Enterprise as its native search engine.
This integration allows for powerful searching capabilities within Splunk SOAR, leveraging Splunk’s robust search and indexing features.
Search Configuration:
While the embedded Splunk search engine is the default, organizations have the option to configure Splunk SOAR to use a different Splunk Enterprise deployment or an external Elasticsearch instance.
This flexibility allows organizations to tailor their search infrastructure to their specific needs and existing environments.
Search Capabilities:
The embedded Splunk search engine enables users to perform complex searches, analyze data, and generate reports directly within the Splunk SOAR platform.
It supports the full range of Splunk’s search processing language (SPL) commands, functions, and visualizations.
Reference: Splunk SOAR Documentation: Configure search in Splunk Phantom1.
Splunk SOAR Documentation: Configure search in Splunk SOAR (On-premises)2.
In summary, the embedded Splunk search engine is the default search engine in Splunk SOAR, providing a seamless and powerful search experience for users within the platform.