Splunk SPLK-2003 Practice Exams
Last updated on Oct 07,2026- Exam Code: SPLK-2003
- Exam Name: Splunk SOAR Certified Automation Developer Exam
- Certification Provider: Splunk
- Latest update: Oct 07,2026
Question #101
How can the DECIDED process be restarted?
- A . By restarting the playbook daemon.
- B . On the System Health page.
- C . In Administration > Server Settings.
- D . By restarting the automation service.
Correct Answer: D
D
Explanation:
DECIDED process is a core component of the SOAR automation engine that handles the execution of playbooks and actions. The DECIDED process can be restarted by restarting the automation service, which can be done from the command line using the service phantom restart command2. Restarting the automation service also restarts the playbook daemon, which is another core component of the SOAR automation engine that handles the loading and unloading of playbooks3. Therefore, option D is the correct answer, as it restarts both the DECIDED process and the playbook daemon.
Option A is incorrect, because restarting the playbook daemon alone does not restart the DECIDED process.
Option B is incorrect, because the System Health page does not provide an option to restart the DECIDED process or the automation service.
Option C is incorrect, because the Administration > Server Settings page does not provide an option to restart the DECIDED process or the automation service.
In Splunk SOAR, if the DECIDED process, which is responsible for playbook execution, needs to be restarted, this can typically be done by restarting the automation (or phantom) service. This service manages the automation processes, including playbook execution. Restarting it can reset the DECIDED process, resolving issues related to playbook execution or process hangs.
D
Explanation:
DECIDED process is a core component of the SOAR automation engine that handles the execution of playbooks and actions. The DECIDED process can be restarted by restarting the automation service, which can be done from the command line using the service phantom restart command2. Restarting the automation service also restarts the playbook daemon, which is another core component of the SOAR automation engine that handles the loading and unloading of playbooks3. Therefore, option D is the correct answer, as it restarts both the DECIDED process and the playbook daemon.
Option A is incorrect, because restarting the playbook daemon alone does not restart the DECIDED process.
Option B is incorrect, because the System Health page does not provide an option to restart the DECIDED process or the automation service.
Option C is incorrect, because the Administration > Server Settings page does not provide an option to restart the DECIDED process or the automation service.
In Splunk SOAR, if the DECIDED process, which is responsible for playbook execution, needs to be restarted, this can typically be done by restarting the automation (or phantom) service. This service manages the automation processes, including playbook execution. Restarting it can reset the DECIDED process, resolving issues related to playbook execution or process hangs.
Question #102
What users are included in a new installation of SOAR?
- A . The admin and automation users are included by default.
- B . The admin, power, and user users are included by default.
- C . Only the admin user is included by default.
- D . No users are included by default.
Correct Answer: A
A
Explanation:
The admin and automation users are included by default. Comprehensive Explanation and Reference of Correct Answer According to the Splunk SOAR (On-premises) default credentials, script options, and sample configuration files documentation1, the default credentials on a new installation of Splunk SOAR (On-premises) are:
Web Interface Username: soar_local_admin password: password
On Splunk SOAR (On-premises) deployments which have been upgraded from earlier releases the user account admin becomes a normal user account with the Administrator role.
The automation user is a special user account that is used by Splunk SOAR (On-premises) to run actions and playbooks. It has the Automation role, which grants it full access to all objects and data in Splunk SOAR (On-premises).
The other options are incorrect because they either omit the automation user or include users that are not created by default. For example, option B includes the power and user users, which are not part of the default installation.
Option C only includes the admin user, which ignores the automation user.
Option D claims that no users are included by default, which is false.
In a new installation of Splunk SOAR, two default user accounts are typically created: admin and automation. The admin account is intended for system administration tasks, providing full access to all features and settings within the SOAR platform. The automation user is a special account used for automated processes and scripts that interact with the SOAR platform, often without requiring direct human intervention. This user has specific permissions that can be tailored for automated tasks. Options B, C, and D do not accurately represent the default user accounts included in a new SOAR installation, making option A the correct answer.
A
Explanation:
The admin and automation users are included by default. Comprehensive Explanation and Reference of Correct Answer According to the Splunk SOAR (On-premises) default credentials, script options, and sample configuration files documentation1, the default credentials on a new installation of Splunk SOAR (On-premises) are:
Web Interface Username: soar_local_admin password: password
On Splunk SOAR (On-premises) deployments which have been upgraded from earlier releases the user account admin becomes a normal user account with the Administrator role.
The automation user is a special user account that is used by Splunk SOAR (On-premises) to run actions and playbooks. It has the Automation role, which grants it full access to all objects and data in Splunk SOAR (On-premises).
The other options are incorrect because they either omit the automation user or include users that are not created by default. For example, option B includes the power and user users, which are not part of the default installation.
Option C only includes the admin user, which ignores the automation user.
Option D claims that no users are included by default, which is false.
In a new installation of Splunk SOAR, two default user accounts are typically created: admin and automation. The admin account is intended for system administration tasks, providing full access to all features and settings within the SOAR platform. The automation user is a special account used for automated processes and scripts that interact with the SOAR platform, often without requiring direct human intervention. This user has specific permissions that can be tailored for automated tasks. Options B, C, and D do not accurately represent the default user accounts included in a new SOAR installation, making option A the correct answer.
Question #103
When the Splunk App for SOAR Export executes a Splunk search, which activities are completed?
- A . CEF fields are mapped to CIM fields and a container is created on the SOAR server.
- B . CIM fields are mapped to CEF fields and a container is created on the SOAR server.
- C . CEF fields are mapped to CIM and a container is created on the Splunk server.
- D . CIM fields are mapped to CEF and a container is created on the Splunk server.
Correct Answer: B
B
Explanation:
When the Splunk App for SOAR Export executes a Splunk search, it typically involves mapping Common Information Model (CIM) fields from Splunk to the Common Event Format (CEF) used by SOAR, after which a container is created on the SOAR server to house the related artifacts and information. This process allows for the integration of data between Splunk, which uses CIM for data normalization, and Splunk SOAR, which uses CEF as its data format for incidents and events.
Splunk App for SOAR Export is responsible for sending data from your Splunk Enterprise or Splunk Cloud instances to Splunk SOAR. The Splunk App for SOAR Export acts as a translation service between the Splunk platform and Splunk SOAR by performing the following tasks:
• Mapping fields from Splunk platform alerts, such as saved searches and data models, to CEF
fields.
• Translating CIM fields from Splunk Enterprise Security (ES) notable events to CEF fields.
• Forwarding events in CEF format to Splunk SOAR, which are stored as artifacts.
Therefore, option B is the correct answer, as it states the activities that are completed when the Splunk App for SOAR Export executes a Splunk search.
Option A is incorrect, because CEF fields are not mapped to CIM fields, but the other way around.
Option C is incorrect, because a container is not created on the Splunk server, but on the SOAR server.
Option D is incorrect, because a container is not created on the Splunk server, but on the SOAR server.
B
Explanation:
When the Splunk App for SOAR Export executes a Splunk search, it typically involves mapping Common Information Model (CIM) fields from Splunk to the Common Event Format (CEF) used by SOAR, after which a container is created on the SOAR server to house the related artifacts and information. This process allows for the integration of data between Splunk, which uses CIM for data normalization, and Splunk SOAR, which uses CEF as its data format for incidents and events.
Splunk App for SOAR Export is responsible for sending data from your Splunk Enterprise or Splunk Cloud instances to Splunk SOAR. The Splunk App for SOAR Export acts as a translation service between the Splunk platform and Splunk SOAR by performing the following tasks:
• Mapping fields from Splunk platform alerts, such as saved searches and data models, to CEF
fields.
• Translating CIM fields from Splunk Enterprise Security (ES) notable events to CEF fields.
• Forwarding events in CEF format to Splunk SOAR, which are stored as artifacts.
Therefore, option B is the correct answer, as it states the activities that are completed when the Splunk App for SOAR Export executes a Splunk search.
Option A is incorrect, because CEF fields are not mapped to CIM fields, but the other way around.
Option C is incorrect, because a container is not created on the Splunk server, but on the SOAR server.
Option D is incorrect, because a container is not created on the Splunk server, but on the SOAR server.
Question #104
What do assets provide for app functionality?
- A . Assets provide location, credentials, and other parameters needed to run actions.
- B . Assets provide hostnames, passwords, and other artifacts needed to run actions.
- C . Assets provide Python code, REST API, and other capabilities needed to run actions.
- D . Assets provide firewall, network, and data sources needed to run actions.
Correct Answer: A
A
Explanation:
The correct answer is A because assets provide location, credentials, and other parameters needed to run actions. Assets are configurations that define how Phantom connects to external systems or devices, such as firewalls, endpoints, or threat intelligence sources. Assets specify the app, the IP address or hostname, the username and password, and any other settings required to run actions on the target system or device. The answer B is incorrect because assets do not provide hostnames, passwords, and other artifacts needed to run actions, which are data objects that can be created or retrieved by playbooks. The answer C is incorrect because assets do not provide Python code, REST API, and other capabilities needed to run actions, which are provided by apps. The answer D is incorrect because assets do not provide firewall, network, and data sources needed to run actions, which are external systems or devices that can be connected to by assets.
Reference: Splunk SOAR Admin Guide, page 45. Assets in Splunk Phantom are configurations that contain the necessary information for apps to connect to external systems and services. This information can include IP addresses, domain names, credentials like usernames and passwords, and other necessary parameters such as API keys or tokens. These parameters enable the apps to perform actions like running queries, executing commands, or gathering data. Assets do not provide the actual Python code, REST API capabilities, or network infrastructure; they are the bridge between the apps and the external systems with the configuration data needed for successful communication and action execution
A
Explanation:
The correct answer is A because assets provide location, credentials, and other parameters needed to run actions. Assets are configurations that define how Phantom connects to external systems or devices, such as firewalls, endpoints, or threat intelligence sources. Assets specify the app, the IP address or hostname, the username and password, and any other settings required to run actions on the target system or device. The answer B is incorrect because assets do not provide hostnames, passwords, and other artifacts needed to run actions, which are data objects that can be created or retrieved by playbooks. The answer C is incorrect because assets do not provide Python code, REST API, and other capabilities needed to run actions, which are provided by apps. The answer D is incorrect because assets do not provide firewall, network, and data sources needed to run actions, which are external systems or devices that can be connected to by assets.
Reference: Splunk SOAR Admin Guide, page 45. Assets in Splunk Phantom are configurations that contain the necessary information for apps to connect to external systems and services. This information can include IP addresses, domain names, credentials like usernames and passwords, and other necessary parameters such as API keys or tokens. These parameters enable the apps to perform actions like running queries, executing commands, or gathering data. Assets do not provide the actual Python code, REST API capabilities, or network infrastructure; they are the bridge between the apps and the external systems with the configuration data needed for successful communication and action execution
Question #105
Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment’ Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.
- A . On the command line enter: rode sudo python ibackup.pyc –setup, then audo phenv python ibackup.pyc –backup.
- B . On the command line enter: sudo phenv python ibackup.pyc –backup ―backup-type full, then sudo phenv python ibackup.pyc –setup.
- C . Within the UI: Select from the main menu Administration > System Health > Backup.
- D . Within the UI: Select from the main menu Administration > Product Settings > Backup.
Correct Answer: B
B
Explanation:
The correct answer is B because the steps required to complete a full backup of a Splunk Phantom deployment are to first run the –backup –backup-type full command and then run the — setup command. The –backup command creates a backup file in the /opt/phantom/backup directory. The –backup-type full option specifies that the backup file includes all the data and configuration files of the Phantom server. The –setup command creates a configuration file that contains the encryption key and other information needed to restore the backup file. See Splunk SOAR Certified Automation Developer Track for more details.
Performing a full backup of a Splunk Phantom deployment involves using the command-line interface, primarily because Phantom’s architecture and data management processes are designed to be managed at the server level for comprehensive backup and recovery. The correct sequence involves initiating a full backup first using the –backup –backup-type full option to ensure all configurations, data, and necessary components are included in the backup. Following the completion of the backup, the –setup option might be used to configure or verify the backup settings, although typically, the setup would precede backup operations in practical scenarios. This process ensures that all aspects of the Phantom deployment are preserved, including configurations, playbooks, cases, and other data, which is crucial for disaster recovery and system migration.
B
Explanation:
The correct answer is B because the steps required to complete a full backup of a Splunk Phantom deployment are to first run the –backup –backup-type full command and then run the — setup command. The –backup command creates a backup file in the /opt/phantom/backup directory. The –backup-type full option specifies that the backup file includes all the data and configuration files of the Phantom server. The –setup command creates a configuration file that contains the encryption key and other information needed to restore the backup file. See Splunk SOAR Certified Automation Developer Track for more details.
Performing a full backup of a Splunk Phantom deployment involves using the command-line interface, primarily because Phantom’s architecture and data management processes are designed to be managed at the server level for comprehensive backup and recovery. The correct sequence involves initiating a full backup first using the –backup –backup-type full option to ensure all configurations, data, and necessary components are included in the backup. Following the completion of the backup, the –setup option might be used to configure or verify the backup settings, although typically, the setup would precede backup operations in practical scenarios. This process ensures that all aspects of the Phantom deployment are preserved, including configurations, playbooks, cases, and other data, which is crucial for disaster recovery and system migration.
Question #106
Phantom supports multiple user authentication methods such as LDAP and SAML2.
What other user authentication method is supported?
- A . SAML3
- B . PIV/CAC
- C . Biometrics
- D . OpenID
Correct Answer: B
B
Explanation:
Splunk SOAR supports multiple user authentication methods to ensure secure access to the platform. Apart from LDAP (Lightweight Directory Access Protocol) and SAML2 (Security Assertion Markup Language 2.0), SOAR also supports PIV (Personal Identity Verification) and CAC (Common Access Card) as authentication methods. These are particularly used in government and military organizations for secure and authenticated access to systems, providing a high level of security through physical tokens or cards that contain encrypted user credentials.
B
Explanation:
Splunk SOAR supports multiple user authentication methods to ensure secure access to the platform. Apart from LDAP (Lightweight Directory Access Protocol) and SAML2 (Security Assertion Markup Language 2.0), SOAR also supports PIV (Personal Identity Verification) and CAC (Common Access Card) as authentication methods. These are particularly used in government and military organizations for secure and authenticated access to systems, providing a high level of security through physical tokens or cards that contain encrypted user credentials.
Question #107
How can more than one user perform tasks in a workbook?
- A . Any user in a role with write access to the case’s workbook can be assigned to tasks.
- B . Add the required users to the authorized list for the container.
- C . Any user with a role that has Perform Task enabled can execute tasks for workbooks.
- D . The container owner can assign any authorized user to any task in a workbook.
Correct Answer: C
C
Explanation:
In Splunk SOAR, tasks within workbooks can be performed by any user whose role has the ‘Perform Task’ capability enabled. This capability is assigned within the role configuration and allows users with the appropriate permissions to execute tasks. It is not limited to users with write access or the container owner; rather, it is based on the specific permissions granted to the role with which the user is associated.
C
Explanation:
In Splunk SOAR, tasks within workbooks can be performed by any user whose role has the ‘Perform Task’ capability enabled. This capability is assigned within the role configuration and allows users with the appropriate permissions to execute tasks. It is not limited to users with write access or the container owner; rather, it is based on the specific permissions granted to the role with which the user is associated.
Question #108
How can parent and child playbooks pass information to each other?
- A . The parent can pass arguments to the child when called, and the child can return values from the end block.
- B . The parent can pass arguments to the child when called, but the child can only pass values back as new artifacts in the event.
- C . The parent must create a new artifact in the event named arg_xxx, and the child must return values by creating artifacts with the naming convention return_xxx.
- D . The parent must create a new artifact in the event named return_xxx, and the child must return values by creating artifacts with the naming convention arg_xxx.
Correct Answer: A
A
Explanation:
In Splunk SOAR, parent and child playbooks can pass information between each other using arguments. The parent playbook can pass specific arguments to the child playbook when it is called, enabling the child playbook to utilize these values in its execution. Once the child playbook finishes its execution, it can return values through the end block. This mechanism allows for efficient and structured communication between parent and child playbooks, enabling complex, multi-step automation workflows.
Other options are incorrect because creating artifacts with specific naming conventions is not necessary for passing information between playbooks, and artifacts are not used for argument or result passing between playbooks in this manner.
Reference: Splunk SOAR Documentation: Playbook Development Guide.
Splunk SOAR Best Practices: Parent and Child Playbooks Communication.
A
Explanation:
In Splunk SOAR, parent and child playbooks can pass information between each other using arguments. The parent playbook can pass specific arguments to the child playbook when it is called, enabling the child playbook to utilize these values in its execution. Once the child playbook finishes its execution, it can return values through the end block. This mechanism allows for efficient and structured communication between parent and child playbooks, enabling complex, multi-step automation workflows.
Other options are incorrect because creating artifacts with specific naming conventions is not necessary for passing information between playbooks, and artifacts are not used for argument or result passing between playbooks in this manner.
Reference: Splunk SOAR Documentation: Playbook Development Guide.
Splunk SOAR Best Practices: Parent and Child Playbooks Communication.
Question #109
On a multi-tenant Phantom server, what is the default tenant’s ID?
- A . 0
- B . Default
- C . 1
- D . *
Correct Answer: C
C
Explanation:
The correct answer is C because the default tenant’s ID is 1. The tenant ID is a unique identifier for each tenant on a multi-tenant Phantom server. The default tenant is the tenant that is created when Phantom is installed and contains all the existing data and assets. The default tenant’s ID is always 1 and cannot be changed. Other tenants have IDs that are assigned sequentially starting from 2.
See Splunk SOAR Documentation for more details. In a multi-tenant Splunk SOAR environment, the default tenant is typically assigned an ID of 1. This ID is system-generated and is used to uniquely identify the default tenant within the SOAR database and system configurations. The default tenant serves as the primary operational environment before any additional tenants are configured, and its ID is crucial for database operations, API calls, and internal reference within the SOAR platform. Understanding and correctly using tenant IDs is essential for managing resources, permissions, and data access in a multi-tenant SOAR setup.
C
Explanation:
The correct answer is C because the default tenant’s ID is 1. The tenant ID is a unique identifier for each tenant on a multi-tenant Phantom server. The default tenant is the tenant that is created when Phantom is installed and contains all the existing data and assets. The default tenant’s ID is always 1 and cannot be changed. Other tenants have IDs that are assigned sequentially starting from 2.
See Splunk SOAR Documentation for more details. In a multi-tenant Splunk SOAR environment, the default tenant is typically assigned an ID of 1. This ID is system-generated and is used to uniquely identify the default tenant within the SOAR database and system configurations. The default tenant serves as the primary operational environment before any additional tenants are configured, and its ID is crucial for database operations, API calls, and internal reference within the SOAR platform. Understanding and correctly using tenant IDs is essential for managing resources, permissions, and data access in a multi-tenant SOAR setup.
Question #110
Which of the following describes the use of labels in Phantom?
- A . Labels determine the service level agreement (SLA) for a container.
- B . Labels control the default seventy, ownership, and sensitivity for the container.
- C . Labels control which apps are allowed to execute actions on the container.
- D . Labels determine which playbook(s) are executed when a container is created.
Correct Answer: D
D
Explanation:
In Splunk Phantom, labels are used to categorize containers and trigger specific automated responses. When a container is created, labels can be assigned to it based on the nature of the event, type of incident, or other criteria. These labels are then matched against playbooks, which have label conditions defined within them. When the conditions are met, the corresponding playbooks are automatically executed. Labels do not directly control service level agreements, default severity, ownership, sensitivity, or app execution permissions.
D
Explanation:
In Splunk Phantom, labels are used to categorize containers and trigger specific automated responses. When a container is created, labels can be assigned to it based on the nature of the event, type of incident, or other criteria. These labels are then matched against playbooks, which have label conditions defined within them. When the conditions are met, the corresponding playbooks are automatically executed. Labels do not directly control service level agreements, default severity, ownership, sensitivity, or app execution permissions.