Describe the Function of GET, POST, and Search Workflow Actions SPLK-1002 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst frequently sees an IP address in search results and wants to click it to run a new search for all events related to that IP in the last 24 hours. The analyst wants this to happen directly within Splunk. Which workflow action type should be configured?

   • ASearch workflow action
   • BReport workflow action
   • CGET workflow action
   • DPOST workflow action
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What does a Search workflow action do when triggered?

   • AIt exports the current results to a CSV file.
   • BIt sends an HTTP POST request with field values in the body.
   • CIt sends an HTTP GET request to an external URL.
   • DIt runs a new Splunk search using selected field values as arguments.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which scenario is most appropriate for using a POST workflow action?

   • ADisplaying an image from an external server
   • BOpening a simple lookup page that expects parameters in the URL
   • CRunning a new Splunk search with field values as arguments
   • DSubmitting a form to a web service that processes the data
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Splunk admin is evaluating three workflow actions for different use cases: opening an external URL with query parameters, submitting a form to a web service, and running a new search. Which of the following correctly lists the action types in the order of these use cases?

   • APOST, GET, Search
   • BSearch, GET, POST
   • CGET, Search, POST
   • DGET, POST, Search
   Reveal Solution Discussion Select an answer first
6. 5expert · hard · select all that apply

   A Splunk admin is configuring workflow actions for a security operations center. The team needs to: 1) open an external threat intelligence page using a field value as a query parameter, 2) submit a field value to a sandboxing service that expects data in the request body, and 3) run a new search for all events related to a field value. Which workflow action types should the admin configure? Select all that apply.

   • AGET workflow action
   • BPOST workflow action
   • CPUT workflow action
   • DSearch workflow action
   Check answers Discussion Select an answer first