Create a POST Workflow Action SPLK-1002 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   When configuring a POST workflow action, what does the 'Label' field control?

   • AThe URI of the external system
   • BThe name of the external system's database table
   • CThe text that appears in the workflow action menu for users
   • DThe HTTP header sent to the external system
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How can you include dynamic search result values in the POST request body of a workflow action?

   • ABy hardcoding the values in the request body
   • BBy using a saved search to populate the body
   • CBy using tokens such as $result.field_name$
   • DBy using a lookup table to map values
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What should you check to ensure a POST workflow action is handling responses appropriately?

   • AThe response status code and any error messages returned by the external system
   • BThe Splunk index size
   • CThe search results in the Splunk UI
   • DThe number of tokens in the configuration
   Reveal Solution Discussion Select an answer first
5. 4application · easy

   A SOC team wants to automatically send the details of a suspicious event to a sandbox analysis service when an analyst clicks a workflow action. The service accepts data via HTTP POST. What is the primary function of a POST workflow action in this scenario?

   • AIt opens a new Splunk search window with the event data as the search query.
   • BIt saves the event data to a Splunk index for later analysis.
   • CIt sends the selected event data to the external service using an HTTP POST request.
   • DIt retrieves additional information about the event from the external service using an HTTP GET request.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After configuring a POST workflow action that sends event data to an external API, a user reports that the action appears to succeed but the API receives an empty body. The workflow action is linked to a search that returns events. What is the most likely cause?

   • AThe workflow action is using the GET method instead of POST.
   • BThe tokens in the request body are not being replaced because the field names do not match the search results.
   • CThe URI is incorrect and the request is being sent to a different endpoint.
   • DThe content type is set to application/json but the body is form-encoded.
   Reveal Solution Discussion Select an answer first