Free SPLK-2003 Practice Test Questions and Answers (2026)

To return all artifacts that contain a SHA1 file hash using the Splunk SOAR REST API, the correct

query would use the _filter_cef_Shal_contains parameter. This parameter filters the artifacts to only

those that contain a value in the SHA1 field within the Common Event Format (CEF) data

structure. The contains operator is used to match any artifacts that have a SHA1 hash present1.

Reference:

Understanding artifacts - Splunk Documentation

When the Splunk App for SOAR Export executes a Splunk search, it typically involves mapping

Common Information Model (CIM) fields from Splunk to the Common Event Format (CEF) used by

SOAR, after which a container is created on the SOAR server to house the related artifacts and

information. This process allows for the integration of data between Splunk, which uses CIM for data

normalization, and Splunk SOAR, which uses CEF as its data format for incidents and events.

Splunk App for SOAR Export is responsible for sending data from your Splunk Enterprise or Splunk

Cloud instances to Splunk SOAR. The Splunk App for SOAR Export acts as a translation service

between the Splunk platform and Splunk SOAR by performing the following tasks:

•

Mapping fields from Splunk platform alerts, such as saved searches and data models, to CEF

fields.

•

Translating CIM fields from Splunk Enterprise Security (ES) notable events to CEF fields.

•

Forwarding events in CEF format to Splunk SOAR, which are stored as artifacts.

Therefore, option B is the correct answer, as it states the activities that are completed when the

Splunk App for SOAR Export executes a Splunk search. Option A is incorrect, because CEF fields are

not mapped to CIM fields, but the other way around. Option C is incorrect, because a container is not

created on the Splunk server, but on the SOAR server. Option D is incorrect, because a container is

not created on the Splunk server, but on the SOAR server.

Splunk SOAR (formerly Phantom) does not natively run on Windows servers as it is primarily

designed for Linux environments. However, it can be deployed on a Windows server through

virtualization. By running the Phantom OVA (Open Virtualization Appliance) as a virtual machine,

users can utilize virtualization platforms like VMware or VirtualBox on a Windows server to host the

Phantom environment. This approach allows for the deployment of Phantom in a Windows-centric

infrastructure by leveraging virtualization technology to encapsulate the Phantom application within

a supported Linux environment provided by the OVA.

The correct answer is B because an active playbook can be configured to operate on all containers

that share a label. A label is a user-defined attribute that can be applied to containers to group them

by a common characteristic, such as source, type, severity, etc. Labels can be used to filter containers

and trigger active playbooks based on the label value. See Splunk SOAR Documentation for more

details.

In Splunk SOAR, labels are used to categorize containers (such as incidents or events) based on their

characteristics or the type of security issue they represent. An active playbook can be configured to

trigger on all containers that share a specific label, enabling targeted automation based on the

nature of the incident. This functionality allows for efficient and relevant playbook execution,

ensuring that the automated response is tailored to the specific requirements of the container's

category. Labels serve as a powerful organizational tool within SOAR, guiding the automated

response framework to act on incidents that meet predefined criteria, thus streamlining the security

operations process.

In Splunk SOAR, playbooks can execute actions either synchronously (waiting for one action to

complete before starting the next) or asynchronously (allowing actions to run concurrently). If a

playbook starts executing before the previous one has completed, it indicates that synchronous

execution has not been properly configured between these playbooks. This is crucial when the

output of one playbook is a dependency for the subsequent playbook. Options B, C, and D do not

directly address the observed behavior of concurrent playbook execution, making option A the most

accurate explanation for why the second playbook starts before the completion of the first.

synchronous execution is a feature of the SOAR automation engine that allows you to control the

order of execution of playbook blocks. Synchronous execution ensures that a playbook block waits for

the completion of the previous block before starting its execution. Synchronous execution can be

enabled or disabled for each playbook block in the playbook editor, by toggling the Synchronous

Execution switch in the block settings. Therefore, option A is the correct answer, as it states the cause

of the behavior where the second playbook starts executing before the first one completes. Option B

is incorrect, because the first playbook performing poorly is not the cause of the behavior, but rather

a possible consequence of the behavior. Option C is incorrect, because the sleep option for the

second playbook is not the cause of the behavior, but rather a workaround that can be used to delay

the execution of the second playbook. Option D is incorrect, because the join configuration on the

second playbook is not the cause of the behavior, but rather a way of merging multiple paths of

execution into one.

The primary objective of using the I2A2 playbook design methodology in Splunk SOAR is to create

playbooks that are simple, reusable, and modular. This design philosophy emphasizes the creation of

playbooks that can be easily understood and maintained, encourages the reuse of playbook

components in different scenarios, and fosters the development of playbooks that can be modularly

connected or used independently as needed.

I2A2 design methodology is a framework for designing playbooks that consists of four components:

•

Inputs: The data that is required for the playbook to run, such as artifacts, parameters, or

custom fields.

•

Interactions: The blocks that allow the playbook to communicate with users or other

systems, such as prompts, comments, or emails.

•

Actions: The blocks that execute the core logic of the playbook, such as app actions, filters,

decisions, or utilities.

•

Artifacts: The data that is generated or modified by the playbook, such as new artifacts,

container fields, or notes.

The I2A2 design methodology helps you to plan, structure, and test your playbooks in a modular and

efficient way. The primary objective of using the I2A2 design methodology is to create simple,

reusable, modular playbooks that can be easily maintained, shared, and customized. Therefore,

option D is the correct answer, as it states the primary objective of using the I2A2 design

methodology. Option A is incorrect, because creating detailed playbooks is not the primary objective

of using the I2A2 design methodology, but rather a possible outcome of following the framework.

Option B is incorrect, because creating playbooks that customers will not edit is not the primary

objective of using the I2A2 design methodology, but rather a potential risk of not following the

framework. Option C is incorrect, because meeting customer requirements using a single playbook is

not the primary objective of using the I2A2 design methodology, but rather a challenge that can be

overcome by using the framework.

1: Use a playbook design methodology in Administer Splunk SOAR (Cloud).

The global block within a Splunk SOAR playbook is primarily used to import external packages or

define global variables that will be utilized across various parts of the playbook. This block sets the

stage for the playbook by ensuring that all necessary libraries, modules, or predefined variables are

available for use in subsequent actions, decision blocks, or custom code segments within the

playbook. This practice promotes code reuse and efficiency, enabling more sophisticated and

powerful playbook designs by leveraging external functionalities.

When building a playbook in Splunk SOAR, if the desired artifact value does not appear in the auto-

populated list of input parameters for an action, users have the option to manually enter the

Common Event Format (CEF) datapath for that value. This allows for greater flexibility and

customization in playbook design, ensuring that specific data points can be targeted even if they're

not immediately visible in the interface. This manual entry of CEF datapaths allows users to directly

reference the necessary data within artifacts, bypassing limitations of the auto-populated list.

Options B, C, and D suggest alternative methods that are not typically used for this purpose, making

option A the correct and most direct approach to entering an unlisted artifact value in a playbook

action.

When assigning an input parameter to an action while building a playbook, a user can use the auto-

populated list of artifact values that match the expected data type for the parameter. The auto-

populated list is based on the contains parameter of the action inputs and outputs, which enables

contextual actions in the SOAR user interface. However, the auto-populated list may not include all

the possible artifact values that can be used as parameters, especially if the artifact values are nested

or have uncommon data types. In that case, the user can type the CEF datapath in manually, using

the syntax artifact.., where field is the name of the artifact field, such as cef, and key is

the name of the subfield within the artifact field, such as sourceAddress. Typing the CEF datapath in

manually allows the user to enter the unlisted artifact value as an input parameter to the action.

Therefore, option A is the correct answer, as it states how it is possible to enter the unlisted artifact

value. Option B is incorrect, because deleting and recreating the artifact is not a way to enter the

unlisted artifact value, but rather a way to lose the existing artifact data. Option C is incorrect,

because editing the artifact to enable the List as Parameter option for the CEF value is not a way to

enter the unlisted artifact value, but rather a way to make the artifact value appear in the auto-

populated list. Option D is incorrect, because editing the container to allow CEF parameters is not a

way to enter the unlisted artifact value, but rather a way to modify the container properties, which

are not related to the action parameters.

To restrict playbook execution to members of the admin role within Splunk SOAR, the 'Execute

Playbook' capability must be managed appropriately. This is done by ensuring that this capability is

removed from all other roles except the admin role. Role-based access control (RBAC) in Splunk

SOAR allows for granular permissions, which means you can configure which roles have the ability to

execute playbooks, and by restricting this capability, you can control which users are able to initiate

playbook runs.

DECIDED process is a core component of the SOAR automation engine that handles the execution of

playbooks and actions. The DECIDED process can be restarted by restarting the automation service,

which can be done from the command line using the service phantom restart command2. Restarting

the automation service also restarts the playbook daemon, which is another core component of the

SOAR automation engine that handles the loading and unloading of playbooks3. Therefore, option D

is the correct answer, as it restarts both the DECIDED process and the playbook daemon. Option A is

incorrect, because restarting the playbook daemon alone does not restart the DECIDED process.

Option B is incorrect, because the System Health page does not provide an option to restart the

DECIDED process or the automation service. Option C is incorrect, because the Administration >

Server Settings page does not provide an option to restart the DECIDED process or the automation

service.

In Splunk SOAR, if the DECIDED process, which is responsible for playbook execution, needs to be

restarted, this can typically be done by restarting the automation (or phantom) service. This service

manages the automation processes, including playbook execution. Restarting it can reset the

DECIDED process, resolving issues related to playbook execution or process hangs.

In Splunk SOAR, when working on a case and analyzing events, items marked as significant evidence

are aggregated for review. These evidence items can be collectively viewed on the Investigation page

under the Evidence tab. This centralized view allows analysts to easily access and review all marked

evidence related to a case, facilitating a streamlined analysis process and ensuring that key

information is readily available for investigation and decision-making.

A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would

permit only non-null IP addresses to pass forward to the next block. The !- operator means “is not

null”. The other options are not valid because they either include null values or other fields than

sourceAddress. See Filter block for more details. A filter block in Splunk SOAR that is configured with

the condition artifact.*.cef.sourceAddress != (assuming the intention was to use "!=" to denote 'not

equal to') is designed to allow data that has non-null sourceAddress values to pass through to

subsequent blocks. This means that any artifact data within the container that includes a

sourceAddress field with a defined value (i.e., an actual IP address) will be permitted to move

forward in the playbook. The filter effectively screens out any artifacts that do not have a source

address specified, focusing the playbook's actions on those artifacts that contain valid IP address

information in the sourceAddress field.

The Files tab on the Investigate page allows the user to upload, download, and view files related to

an investigation. A user can upload the output from a detonate action to the Files tab for further

investigation, such as analyzing the file metadata, content, or hash. Files tab items and artifacts are

not the only data sources that can populate active cases, as cases can also include events, tasks,

notes, and comments. Files tab items can be added to investigations by using the add file action

block or the Add File button on the Files tab. Phantom memory requirements may increase

depending on the Files tab usage, as files are stored in the Phantom database.

The Files tab on the Investigate page in Splunk Phantom is an area where users can manage and

analyze files related to an investigation. Users can upload files, such as outputs from a 'detonate file'

action which analyzes potentially malicious files in a sandbox environment. The files tab allows users

to store and further investigate these outputs, which can include reports, logs, or any other file types

that have been generated or are relevant to the investigation. The Files tab is an integral part of the

investigation process, providing easy access to file data for analysis and correlation with other

incident data.

Decision blocks are most useful when selecting one (or zero) possible paths in the playbook. Decision

blocks allow the user to define one or more conditions based on action results, artifacts, or custom

expressions, and execute the corresponding path if the condition is met. If none of the conditions are

met, the playbook execution ends. Decision blocks are not used for processing different data in

parallel, evaluating complex, multi-value results or artifacts, or modifying downstream data in one or

more paths in the playbook. Decision blocks within Splunk Phantom playbooks are used to control

the flow of execution based on certain criteria. They are most useful when you need to select one or

potentially no paths for the playbook to follow, based on the evaluation of specified conditions. This

is akin to an if-else or switch-case logic in programming where depending on the conditions met, a

particular path is chosen for further actions. Decision blocks evaluate the data and direct the

playbook to different paths accordingly, making them a fundamental component for creating

dynamic and responsive automation workflows.

The correct answer is C because after a playbook has run, the results are stored in the container that

triggered the playbook. The container is a data object that represents an event or a case in Phantom.

The container contains information such as the name, the description, the severity, the status, the

owner, and the labels of the event or case. The container also contains the artifacts, the action

results, the comments, the notes, and the phases and tasks associated with the event or case. The

answer A is incorrect because after a playbook has run, the results are not stored in a Splunk index,

which is a data structure that stores events from various data sources in Splunk. The Splunk index is

not directly accessible by Phantom, but can be queried by Phantom using the Splunk app. The

answer B is incorrect because after a playbook has run, the results are not stored in a case, which is a

type of container that represents a security incident in Phantom. The case is a subset of the

container, and not all containers are cases. The answer D is incorrect because after a playbook has

run, the results are not stored in a log file, which is a file that records the activities or events that

occur in a system or a process. The log file is not a data object in Phantom, but can be a data source

for Phantom. Reference: Splunk SOAR User Guide, page 19. In Splunk Phantom, after a playbook has

been executed, the results of the actions within that playbook are stored in the container associated

with the event. A container is a data structure that encapsulates all relevant information and data for

an incident or event within Phantom, including action results, artifacts, notes, and more. The

container allows users to see a consolidated view of all the data and activity related to a particular

event. These results are not stored in the Splunk Index, a separate case, or a log file as their primary

storage but may be sent to a Splunk index for further analysis.

Under Asset Ingestion Settings in Splunk SOAR, when configuring an asset, the number of labels that

must be applied can be zero or more. Labels are optional and are used to categorize data and control

access. They are not a requirement under Asset Ingestion Settings, but they can be used to enhance

organization and filtering if chosen.

The primary system requirement that should be increased with heavy usage of the file vault is the

amount of storage. The file vault is a secure repository for storing files on Phantom. The more files

are stored, the more storage space is needed. The other options are not directly related to the file

vault usage. See [File vault] for more information.

Heavy usage of the file vault in Splunk SOAR necessitates an increase in the amount of storage

available. The file vault is used to securely store files associated with cases, such as malware samples,

logs, and other artifacts relevant to an investigation. As the volume of files and the size of stored data

grow, ensuring sufficient storage capacity becomes critical to maintain performance and ensure that

all necessary data is retained for analysis and evidence.

The correct answer is C because configuring Phantom search to use an external Splunk server allows

you to automate Splunk searches within Phantom using the run query action. This action can be used

to run any Splunk search command on the external Splunk server and return the results to Phantom.

You can also use the format results action to parse the results and use them in other blocks.

See Splunk SOAR Documentation for more details.

Configuring Phantom (now known as Splunk SOAR) to use an external Splunk server enhances the

automation capabilities within Phantom by allowing the execution of Splunk searches as part of the

automation and orchestration processes. This integration facilitates the automation of tasks that

involve querying data from Splunk, thereby streamlining security operations and incident response

workflows. Splunk SOAR's ability to integrate with over 300 third-party tools, including Splunk,

supports a wide range of automatable actions, thus enabling a more efficient and effective security

operations center (SOC) by reducing the time to respond to threats and by making repetitive tasks

more manageable

https://www.splunk.com/en_us/products/splunk-security-orchestration-and-automationfeatures.html

The correct answer is A because after a successful POST to a Phantom REST endpoint to create a new

object, the result returned is the new object ID. The object ID is a unique identifier for each object in

Phantom, such as a container, an artifact, an action, or a playbook. The object ID can be used to

retrieve, update, or delete the object using the Phantom REST API. The answer B is incorrect because

after a successful POST to a Phantom REST endpoint to create a new object, the result returned is not

the new object name, which is a human-readable name for the object. The object name can be used

to search for the object using the Phantom web interface. The answer C is incorrect because after a

successful POST to a Phantom REST endpoint to create a new object, the result returned is not the

full CEF name, which is a standard format for event data. The full CEF name can be used to access the

CEF fields of an artifact using the Phantom REST API. The answer D is incorrect because after a

successful POST to a Phantom REST endpoint to create a new object, the result returned is not the

PostGres UUID, which is a unique identifier for each row in a PostGres database. The PostGres UUID

is not exposed to the Phantom REST API. Reference: Splunk SOAR REST API Guide, page 17. When a

POST request is made to a Phantom REST endpoint to create a new object, such as an event, artifact,

or container, the typical response includes the ID of the newly created object. This ID is a unique

identifier that can be used to reference the object within the system for future operations, such as

updating, querying, or deleting the object. The response does not usually include the full name or

other specific details of the object, as the ID is the most important piece of information needed

immediately after creation for reference purposes.

The correct answer is C because the best way to restrict the execution of playbooks to members of

the admin role is to make sure the Execute Playbook capability is removed from all roles except

admin. The Execute Playbook capability is a permission that allows a user to run any playbook on any

container. By default, all roles have this capability, but it can be removed or added in the Phantom UI

by going to Administration > User Management > Roles. Removing this capability from all roles

except admin will ensure that only admin users can execute playbooks. See Splunk SOAR

Documentation for more details. To ensure that only members of the admin role can execute specific

playbooks on the Phantom server, the most effective approach is to manage role-based access

controls (RBAC) directly. By configuring the system to remove the "Execute Playbook" capability from

all roles except for the admin role, you can enforce this rule. This method leverages Phantom's built-

in RBAC mechanisms to restrict playbook execution privileges. It is a straightforward and secure way

to ensure that only users with the necessary administrative privileges can initiate the execution of

sensitive or critical playbooks, thus maintaining operational security and control.