Splunk SPLK-2003 - Splunk SOAR Certified Automation Developer Exam
Page: 3 / 18
Total 89 questions
Question #11 (Topic: Exam A)
Which of the following items cannot be modified once entered into SOAR?
A. A comment.
B. A note.
C. A container.
D. An artifact.
Answer: A
Question #12 (Topic: Exam A)
After a playbook has run, where are the results stored?
A. Container
B. Log file
C. Case
D. Splunk Index
Answer: A
Question #13 (Topic: Exam A)
Which of the following accurately describes the Files tab on the Investigate page?
A. Files tab items cannot be added to investigations. Instead, add them to action blocks.
B. SOAR memory requirements remain static, regardless of Files tab usage.
C. Files tab items and artifacts are the only data sources that can populate active cases.
D. A user can upload the output from a detonate action to the Files tab for further investigation.
Answer: D
Question #14 (Topic: Exam A)
Which of the following can be done with the System Health Display?
A. Partially rewind processes, which is useful for debugging.
B. Create a temporary, edited version of a process and test the results.
C. Reset DECIDED to reset playbook environments back to at-start conditions.
D. View a single column of status for SOAR processes. For metrics, click Details.
Answer: D
Question #15 (Topic: Exam A)
What values can be applied when creating Custom CEF fields?
A. Name, Data Type
B. Name
C. Name, Value
D. Name, Data Type, Severity
Answer: A
