• Home
• Splunk Exams
• SPLK-2003 - Splunk SOAR Certified Automation Developer

SPLK-2003 Splunk Practice Test Questions and Exam Dumps

Question 1

What is one of the primary purposes of using the format block in a logic-based automation or scripting system?

A. To generate string parameters for automated action blocks.
B. To create text strings that merge static text with dynamic values for input or output.
C. To generate arrays for input into other functions.
D. To generate HTML or CSS content for output in email messages, user prompts, or comments.

Answer: B

Explanation:
The format block is a utility commonly found in logic-based automation platforms and low-code or no-code environments. Its primary role is to allow users to construct dynamic text outputs by combining static strings (fixed parts of a sentence or phrase) with dynamic values (such as variables, user inputs, or the output of other blocks). This makes the format block especially useful for crafting customized messages, constructing data outputs, or formatting input for further processing.

Option B correctly describes this core function. The format block enables users to merge static text with variable data, creating outputs such as “Hello, John!” where “John” is a value pulled from another part of the system, like a user profile or form input. The block typically uses placeholder tokens like {0}, {1}, etc., that correspond to the order of inserted variables.

Option A is partially accurate, in that a format block may indeed help prepare a string used as a parameter for an action block. However, this is more of a use case rather than a definition of what the format block is designed for. The key function is formatting strings, not specifically generating parameters for actions.

Option C is incorrect because format blocks deal with strings, not arrays. There are often separate utilities or functions for creating and manipulating arrays, which are different data types and structures entirely.

Option D is misleading. While it's theoretically possible to use a format block to assemble pieces of HTML or CSS (since these are ultimately strings), the format block itself is not specifically intended for generating web content. Specialized blocks or templates would more appropriately handle formatting for HTML emails, styled messages, or user interfaces. The primary purpose remains textual string formatting, regardless of whether the result is ultimately embedded in web content.

Therefore, when you're building systems that require dynamic messages—like inserting a user's name into a greeting, combining numbers into a sentence, or creating output logs with values—the format block is your go-to tool. It streamlines how dynamic and static content is combined into a readable, human-friendly string. This makes B the most accurate and complete answer based on the function described.

Question 2

While conducting a second test of a playbook, a user encounters an error that says: "an empty parameters list was passed to phantom.act()." What does this error message mean?

A. The container has artifacts not parameters.
B. The playbook is using an incorrect container.
C. The playbook debugger's scope is set to all.
D. The playbook debugger's scope is set to new.

Answer: D

Explanation:
The error message "an empty parameters list was passed to phantom.act()" indicates that the action function in the playbook is being triggered without any parameters. This typically occurs when the playbook tries to run an action that requires input, but no valid input data is passed to it.

In the context of testing playbooks in tools like Splunk SOAR (formerly Phantom), the playbook debugger has a scope setting that determines how artifacts and data are selected and passed to the playbook during execution. The debugger can be configured to run the playbook against:

• New: Only the artifacts that were added since the last run.

• All: All artifacts present in the container.

Option D, "The playbook debugger's scope is set to new," is the correct answer. If the debugger is set to "new" and the second test run does not introduce any new artifacts, then the playbook will not find any parameters to act upon. As a result, when the phantom.act() function runs, it receives an empty list of parameters, causing the error.

Option A is misleading. Artifacts and parameters are different. Artifacts are units of data attached to a container, and parameters are derived from artifacts or custom inputs. Saying "the container has artifacts not parameters" is not accurate because parameters are generated based on the playbook logic and the artifacts it processes.

Option B, stating the playbook is using an incorrect container, is also incorrect. The container might still be valid; the issue lies not in which container is being used, but in whether that container has new data for the playbook to act on given the debugger's scope.

Option C, "The playbook debugger's scope is set to all," would typically prevent this error. If the scope were set to all, the playbook would have access to all existing artifacts in the container, and it would more likely have valid parameters to use in the phantom.act() call.

Therefore, the most likely cause of the error is that the debugger is set to process only new artifacts, but none were added between tests, leading to an empty parameter list during the second run. To avoid this, users can either reset the debugger scope to "all" or ensure new artifacts are added before each test.

Question 3

On the Investigation page, which of the following elements can be edited or removed?

A. Action results
B. Comments
C. Artifact values
D. Approval records

Answer: B

Explanation:
The Investigation page in a security orchestration or incident response platform, such as Palo Alto Networks Cortex XSOAR, is a workspace where analysts manage and investigate security incidents. This page is designed to provide visibility into the ongoing incident, actions taken, related artifacts, and any comments or collaboration between analysts and teams. Understanding what elements are editable or removable on this page is crucial for maintaining data integrity and managing collaborative efforts.

Option B, comments, is the correct answer because comments added to the investigation timeline or thread are designed to support collaboration between team members. These are typically user-generated inputs and therefore can be edited or deleted by the person who created them or by users with sufficient permissions. The ability to manage comments ensures that analysts can correct mistakes, update notes, or remove irrelevant content if necessary.

Option A, action results, refers to the outcomes of automated or manual actions run as part of a playbook or investigation. These results are typically system-generated and are meant to serve as an audit trail or reference for what occurred during the incident handling process. Because they are crucial for documentation and traceability, action results cannot be edited or deleted. Modifying them would compromise the forensic quality and trustworthiness of the investigation record.

Option C, artifact values, refers to pieces of data collected during the investigation such as IP addresses, file hashes, domains, or user accounts. These values are usually automatically extracted or manually added for enrichment and correlation. Although artifacts themselves can sometimes be added or enriched further, the original values captured in the investigation are typically not deletable or directly editable, especially in platforms that value evidence preservation.

Option D, approval records, involve documented decisions made by authorized individuals regarding actions like quarantining a device, notifying a user, or escalating an incident. These are treated as part of the formal audit trail and compliance documentation, and as such, cannot be edited or deleted. Allowing changes to these would weaken the integrity of the approval process and could create legal or operational risks.

In summary, of all the listed options, only comments are designed for user flexibility and are editable or deletable. This supports dynamic communication during investigations without compromising the factual integrity of logged actions and evidence. Therefore, the correct answer is B.

Question 4

What is the primary function of utilizing a customized workbook in SOAR?

A. Workbooks automatically implement a customized processing of events using Python code.
B. Workbooks apply service level agreements (SLAs) to containers and monitor completion status on the ROI dashboard.
C. Workbooks guide user activity and coordination during event analysis and case operations.
D. Workbooks may not be customized; only default workbooks are permitted within SOAR.

Answer: C

Explanation:
In Splunk SOAR (Security Orchestration, Automation, and Response), a workbook is a structured, customizable tool used to guide analysts and teams through the event response process. The main purpose of a customized workbook is to define and streamline workflows, coordinate team efforts, and provide a checklist-like interface to ensure that all steps in a security incident or investigation are followed appropriately.

Option C is the correct answer because customized workbooks are designed specifically to assist with organizing and guiding user actions during the analysis and response of events. These workbooks are tailored to reflect an organization's internal processes, including steps for containment, investigation, remediation, and documentation. By customizing workbooks, teams can create specific phases, tasks, and expected actions that match their operational standards, ensuring consistency and thoroughness.

Option A is incorrect because while playbooks in SOAR can execute Python code to automate actions, workbooks themselves are not used for automation through code. Instead, they are manual or semi-automated guides. The role of automation and Python scripting belongs to playbooks, not workbooks.

Option B introduces some confusion. While SLAs and task tracking are important aspects of incident management, they are not the main purpose of customized workbooks. Workbooks help with progress tracking, but their core purpose is to direct human workflows rather than enforce service level metrics or integrate directly with ROI (Return on Investment) dashboards.

Option D is factually incorrect. One of the key features of SOAR workbooks is that they can indeed be customized. Organizations routinely create or modify workbooks to align with their standard operating procedures, compliance needs, and specific response workflows.

In conclusion, the main purpose of using a customized workbook is to facilitate human coordination and maintain structure in the response to incidents or security events. Customization allows organizations to tailor the steps to their own procedures, improving operational efficiency, consistency, and auditability of the incident response process.

Question 5

Which of the following are the default ports that must be configured on Splunk to allow connections from SOAR?

A. SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000)
B. SplunkWeb (8472), SplunkD (8589), HTTP Collector (8962)
C. SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)
D. SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000)

Answer: C

Explanation:
When integrating Palo Alto Networks Cortex XSOAR (or any SOAR solution) with Splunk, it's critical to correctly configure network connectivity so that the platforms can securely and efficiently communicate. Splunk, by default, runs several services that listen on specific ports. These default ports are important because they enable different functionalities such as data collection, API interaction, and web access. Knowing the default ports ensures that proper firewall rules and service configurations are in place to support integration.

The correct default ports for Splunk are:

• SplunkWeb: Port 8000 – This is the default port for accessing the Splunk web interface. It is used for user access to Splunk dashboards and administrative UI.

• SplunkD: Port 8089 – This is the management port used by Splunk for REST API calls, which includes communication between XSOAR and Splunk for operations such as executing queries and retrieving search results.

• HTTP Event Collector (HEC): Port 8088 – This is used to send data into Splunk over HTTP. In SOAR integrations, this is critical when events, logs, or alerts are forwarded from XSOAR to Splunk in real time via the HEC interface.

Option C lists exactly these ports:

• SplunkWeb (8000),

• SplunkD (8089),

• HTTP Collector (8088),

which matches the default configuration of a standard Splunk instance that has HEC enabled. These ports can be customized in Splunk if desired, but unless explicitly reconfigured, these are the ports used out of the box.

Option A is incorrect because it misplaces the port numbers: it lists SplunkWeb as 8088, which is actually the HEC port, and it lists the HTTP Collector as 8000, which is actually the web interface port.

Option B is incorrect because it provides arbitrary port numbers (8472, 8589, 8962) that do not correspond to any known default Splunk configuration. This would only be valid if Splunk was installed with customized ports.

Option D is incorrect because it reverses the port assignments, stating that SplunkWeb runs on 8089 and HTTP Collector on 8000. This is a misconfiguration and would result in failed integration attempts unless Splunk was manually configured to use these port numbers.

Therefore, the correct answer is C, which accurately reflects the default port settings necessary for Splunk to work properly with SOAR integrations.

Question 6

An active playbook can be set up to run on all containers that have which shared characteristic?

A. Tag
B. Label
C. Artifact
D. Severity

Answer: B

Explanation:
In Splunk SOAR, playbooks are automated workflows designed to process and respond to security events. For a playbook to trigger automatically, it must be associated with a certain attribute of a container. The key attribute that determines whether a playbook runs automatically is the label of the container.

Option B, Label, is the correct answer because playbooks are explicitly tied to container labels for triggering. When a container is ingested into SOAR, it is assigned a label, which acts as a category or type. For example, labels might include names like "Phishing", "Malware", or "Endpoint Alert". When creating or editing a playbook, an administrator specifies the label(s) the playbook should respond to. Any container with a matching label will automatically trigger that playbook, as long as it's active.

Option A, Tag, is used for classification and filtering within the SOAR interface but does not determine playbook execution. Tags can help analysts group or search containers more easily, but they are not involved in triggering automated workflows.

Option C, Artifact, refers to the pieces of data within a container—like IP addresses, file hashes, or email headers. While artifacts are crucial for playbook execution (since actions often act on artifact data), they do not control whether a playbook runs. The presence or absence of specific artifacts does not trigger a playbook unless additional custom logic is used within a playbook.

Option D, Severity, is a priority level assigned to containers (e.g., Low, Medium, High, Critical). Severity can influence human decision-making or be used within a playbook to conditionally branch logic, but it is not the primary attribute for triggering automatic playbook execution.

To summarize, the automation system within SOAR uses the label of a container as the critical attribute to determine which active playbooks are eligible to run. When containers are ingested, they are checked against the labels defined in active playbooks. If a match is found, the relevant playbooks are automatically initiated. This label-based mechanism ensures organized and scalable automation in diverse security environments.

Question 7

Which visual playbook editor block is used to assemble commands and data into a valid Splunk search within a SOAR playbook?

A. An action block
B. A filter block
C. A prompt block
D. A format block

Answer: D

Explanation:
In Cortex XSOAR or other SOAR platforms with a visual playbook editor, different types of blocks are used to carry out specific operations. Each block serves a unique function that contributes to the automation, decision-making, or interaction flow of the playbook. When dealing with integrations such as Splunk, it becomes essential to construct valid search queries that are syntactically correct and contextually dynamic. This is where the format block plays a central role.

The format block is designed specifically to generate structured strings by combining static text with dynamic variables (placeholders or context values). This capability makes it ideal for assembling search queries, particularly for systems like Splunk that rely on precise syntax in search strings. In this context, the format block allows the playbook author to construct a search by embedding data extracted from previous steps, such as incident details, indicator values, or other contextual information.

For example, suppose you want to search Splunk logs for a specific IP address associated with an incident. You can use a format block to build the following dynamic search string:

search index=firewall_logs src_ip=$ip_address

Here, $ip_address would be dynamically replaced by the actual IP address obtained earlier in the playbook. The format block ensures that the final string passed to the Splunk action is correctly formatted and includes real-time data.

Let's review the other options to clarify why they are not correct:

A. An action block is used to run commands against integrations (like executing a search in Splunk), but it requires a valid input string. It does not build or format that string on its own.

B. A filter block is used to evaluate conditions and determine the path of execution based on logic (true/false), not to assemble strings or search commands.

C. A prompt block is used for human interaction, such as asking an analyst for input during a playbook’s execution. It plays no role in formatting or constructing Splunk searches.

Therefore, the format block is the correct answer because it is specifically used to build valid and dynamic search queries by merging text and variables, which can then be passed to an action block for execution. This block ensures that commands sent to external systems like Splunk are accurately constructed, making it a critical component in SOAR playbooks that interact with search-based platforms.

Question 8

Given two action blocks named geolocate_ip_1 and file_reputation_2 that are connected to a decision block, which of the following configurations correctly evaluates action results from one of these blocks?

A. Select parameter set to: file_reputation_2:action_result.data..response_code; evaluation option set to: ==; and the Select Value set to: custom_list:Banned Countries.
B. Select parameter set to: geolocate_ip_1:action_result.data..country_iso_code; evaluation option set to: in; and the Select Value set to: custom_list:Banned Countries.
C. Select parameter set to: geolocate_ip_1:action_result.cef..country_iso_code; evaluation option set to: !=; and the Select Value box left empty.
D. Select parameter set to: file_reputation_2:action_result.cef..response_code; evaluation option set to: in; and the Select Value set to: United States.

Answer: B

Explanation:
In Splunk SOAR playbooks, decision blocks are used to evaluate the results of previous actions and route the playbook flow accordingly. These decision blocks operate on data returned from earlier actions like geolocate ip or file reputation.

When configuring a decision block, three key elements must be specified:

1. Select parameter – This is the specific field in the action result you want to evaluate.

2. Evaluation option – This is the logical operation used to compare the parameter value (e.g., ==, !=, in, not in).

3. Select value – This is the reference value or list that the parameter will be compared against.

Let’s analyze each option:

Option A is incorrect because it evaluates file_reputation_2:action_result.data.*.response_code using the == operator against a custom list of countries. This is not logically aligned because response codes (like reputation scores or threat indicators) are not directly comparable to a list of country names or ISO codes. There's a mismatch in data type and context.

Option B is correct. It evaluates the field geolocate_ip_1:action_result.data.*.country_iso_code, which returns the ISO country code associated with the geolocated IP. The evaluation operator in is appropriate for checking if the returned country code exists within the custom list named "Banned Countries". This configuration is often used in security workflows to block or alert on traffic from high-risk regions.

Option C is incorrect because it uses cef.*.country_iso_code. The field cef is typically used when referencing artifact fields or CEF-formatted data—not action results. Moreover, leaving the Select Value field empty while using != creates an illogical comparison with no defined target value.

Option D is incorrect for two reasons. First, it uses cef.*.response_code, which again implies a reference to artifact data, not the action result of file_reputation_2. Second, the value United States doesn’t match the expected data for response_code, which is usually a numeric or categorical threat score or classification (not a country).

In summary, option B correctly:

• Selects an action result field that returns country codes.

• Uses the in operator to check for membership in a banned countries list.

• Matches the type of data with the list values, ensuring a valid and useful decision logic in the playbook

Question 9

What is enabled if the Logging option for a playbook's settings is enabled?

A. The playbook will write detailed execution information into the spawn.loq.
B. More detailed information is available in the debug window.
C. All modifications to the playbook will be written to the audit log.
D. More detailed logging information is available in the Investigation page.

Answer: D

Explanation:
When the Logging option is enabled within a playbook's settings in a Security Orchestration, Automation, and Response (SOAR) platform such as Cortex XSOAR, it provides the ability to capture enhanced operational data about the execution of the playbook. This does not refer to internal system or backend log files like spawn.log, nor does it affect playbook editing history in the audit log. Instead, it specifically impacts the level of detail available during the incident investigation process.

The purpose of enabling logging in playbook settings is to ensure that more comprehensive and fine-grained execution details of the playbook become visible in the Investigation page. This page is central to incident management and provides analysts with a timeline and view of the steps taken during an incident’s lifecycle, including automated actions and manual responses. With logging enabled, analysts can view additional information such as input parameters, outputs, intermediate results, and detailed step-by-step execution flows.

This increased visibility is especially useful for troubleshooting, reviewing incident handling behavior, and auditing the outcomes of automated actions. For example, if a specific action in the playbook fails or returns unexpected results, having logging enabled ensures that all related contextual information is available directly within the Investigation tab, allowing analysts to determine the cause more efficiently.

Let’s analyze the other options:

A. This option incorrectly references spawn.log, which is not directly related to user-visible playbook execution logging. This is more of an internal log file, typically used for backend processes and debugging by system administrators.

B. While some information may appear in the debug window during development or testing, enabling the playbook's Logging option does not enhance or influence what appears there. The debug window is tied more closely to developer tools rather than incident response monitoring.

C. The audit log does track changes to the playbook itself (like edits to its structure or configuration), but enabling logging in the playbook’s runtime settings does not affect this audit trail. Logging here refers to execution visibility, not version control or administrative changes.

Thus, the correct answer is D because enabling the Logging option for a playbook directly impacts the level of detail available in the Investigation page, allowing responders to see more in-depth information about how each part of the playbook was executed during an incident.