Splunk SOAR-DEV Practice Test

SOAR-DEV practice test: what's covered

• Playbooks
• apps
• actions
• containers
• custom code
• datapaths

Free SOAR-DEV sample questions

1. A SOC analyst opens a phishing investigation in Splunk SOAR and sees the suspicious email, the extracted URLs, the sender, and the attachment hash all grouped together with notes and a running playbook. Which SOAR object is acting as this top-level grouping record?

   • A. The container, which is the canonical incident record holding artifacts, notes, comments, severity, status, and the playbooks that run against it
   • B. The artifact, which by itself stores the full set of incident notes and the list of playbooks scheduled to execute
   • C. The asset, which represents the credentialed connection to an external product such as the email gateway, and therefore stores all of the grouped incident evidence, notes, and the running playbook itself
   • D. The app, which packages the vendor actions and therefore owns the grouped evidence for the incident
   Show answer

   Correct: A. A container is the incident record that everything attaches to, so it is the correct grouping object. An artifact is only a single observable, not the grouping record, so that choice is incorrect. An asset is a credentialed connection to a tool, and an app is a capability package, so neither groups incident evidence.

2. While building automation, a developer needs to read the source IP and file hash from a single piece of evidence inside a container and have an action enrich those values. Which object stores that individual observable with its CEF fields?

   • A. The asset configuration object, which only stores the credentials used to reach an external enrichment service
   • B. The playbook object, which contains the branching decision and action logic of the automation but does not itself hold any of the observable CEF field values for the incident
   • C. The artifact, a single observable carrying CEF fields like sourceAddress and fileHash that actions read and enrichment results update
   • D. The label, which is a routing tag on the container and holds no per-observable field values
   Show answer

   Correct: C. An artifact carries the CEF observable fields such as sourceAddress and fileHash that actions read, so it is correct. An asset only stores credentials and not observables, so it is incorrect. A playbook holds logic, not observable data, and a label is just a routing tag, so neither is right.

3. A new SOAR administrator is mapping out the platform vocabulary before onboarding the team. Which statements correctly describe the relationship between apps, assets, and actions in Splunk SOAR? (Choose TWO)

   • A. An app is a plugin that adds named actions for a vendor product, such as the VirusTotal app providing 'detonate file' and 'lookup ip'
   • B. An asset is a configured instance of an app holding connection details like URL, API key, or OAuth, and you can have several assets per app
   • C. An action stores the encrypted credentials, while the asset only defines the human-readable display name shown in the UI
   • D. An app can be installed only once per SOAR instance and never exposes more than a single action to playbooks
   • E. An asset is created automatically the moment an app is installed and can never be edited afterward by an administrator
   Show answer

   Correct: A and B. Apps expose named actions and assets are credentialed instances of those apps, so both selected statements are correct. The credential storage claim is wrong because assets, not actions, hold encrypted credentials. The single-action and auto-created claims are incorrect because apps ship many actions and assets are manually configured and editable.

4. In the SOAR visual playbook editor, a developer drags in a node, picks the VirusTotal app and its 'lookup ip' action, and binds the input parameter to the artifact source address so it runs against the configured asset. Which block type was just added?

   • A. A filter block, which only narrows a set of items down to those matching a condition before passing them on
   • B. An action block, which selects an app plus action, maps inputs from playbook context, and executes against the configured asset
   • C. A decision block, which evaluates a boolean expression against prior outputs and routes the run down a true or false path depending on whether the condition is satisfied at runtime
   • D. A format block, which only builds a templated string from values for later use in messages
   Show answer

   Correct: B. Choosing an app, an action, and an asset and binding inputs describes the action block exactly, so it is correct. A filter only subsets data and does not run an app action, so it is wrong. A decision branches on conditions and a format builds strings, so neither executes an action and both are incorrect.

5. A containment playbook should only proceed to block an IP when a prior reputation lookup reports more than five positive detections, and otherwise close the case. Which block lets the developer branch the flow on that condition?

   • A. A prompt block, which pauses the run to collect a manual response from an analyst before continuing
   • B. A filter block, which would silently drop the non-matching items from the data set instead of routing the playbook run down a separate conditional path for each branch
   • C. A decision block, which evaluates a boolean expression on prior outputs and routes the run down true or false branches
   • D. A utility block, which performs helper tasks such as no-op delays and does not branch on conditions
   Show answer

   Correct: C. A decision block evaluates conditions like positives greater than five and routes to true or false paths, so it is correct. A prompt waits for a human and does not branch on data, so it is wrong. A filter drops non-matching items rather than routing branches, and a utility provides helpers, so both are incorrect.

Last updated: 2026-10-19

SOAR-DEV practice test FAQ

Related practice tests

• Splunk SPLK-1002 practice test
• Splunk SPLK-1001 practice test
• Splunk Splunk Admin practice test
• Splunk Splunk ES Admin practice test