Explain the Use of SOAR Playbooks and List the Basic Ways They Can Be Triggered from Enterprise Security. SPLK-5001 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst is creating a new SOAR playbook to handle phishing emails reported by users. The playbook should extract the URL from the email, check it against a threat intelligence service, and if malicious, block the URL and notify the user. What is the correct sequence of steps in the playbook?

   • ABlock URL -> Notify User -> Extract URL -> Check Threat Intel
   • BCheck Threat Intel -> Extract URL -> Block URL and Notify User
   • CExtract URL -> Check Threat Intel -> Decision (Malicious?) -> Block URL and Notify User
   • DNotify User -> Extract URL -> Check Threat Intel -> Block URL
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization has a SOAR playbook that is triggered automatically by a correlation search in Enterprise Security. The playbook is designed to disable a compromised user account. However, the SOC team wants to add a manual approval step before the account is actually disabled. How can this be achieved within the playbook?

   • AUse a 'Decision' block to check if the user is a high-privilege account and only then require approval.
   • BChange the correlation search to not trigger the playbook automatically and require manual triggering.
   • CCreate a second playbook that runs after the first one and disables the account.
   • DAdd a 'Prompt' block in the playbook that requires an analyst to approve or reject the action before it proceeds.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In Splunk SOAR, what is the primary purpose of a playbook?

   • ATo store raw event logs from multiple data sources for long-term compliance retention
   • BTo define a repeatable, automated sequence of actions that analysts can execute to respond to security incidents consistently
   • CTo provide a visual dashboard showing real-time metrics of all active security alerts
   • DTo replace the SIEM correlation engine that generates notable events from raw data
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An organization is implementing SOAR playbooks to automate incident response. They have a playbook that handles 'Account Compromise' events. The playbook currently disables the user account and resets the password. The SOC team wants to add a step to notify the user's manager, but only if the user is a high-privilege account. They also want to ensure that if the notification fails, the playbook still completes successfully. How should the playbook be designed?

   • AAdd a 'Notify Manager' step for all users and configure the playbook to stop on failure.
   • BAdd a decision block to check for high privilege, then a 'Notify Manager' step, and configure the playbook to continue on failure for that step.
   • CCreate a separate playbook for high-privilege accounts that includes the notification step.
   • DAdd a 'Notify Manager' step and use a 'Decision' block after it to check if it succeeded.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is working in Splunk Enterprise Security and has identified a notable event that requires immediate action. They want to run a specific SOAR playbook that is not currently associated with the notable event's default action menu. What is the most efficient way for the analyst to run this playbook?

   • AAsk an administrator to add the playbook to the action menu before proceeding.
   • BUse the 'Run Playbook' action and search for the playbook by name.
   • CManually copy the notable event data into the SOAR platform and run the playbook there.
   • DRecreate the notable event with a different correlation search that has the playbook attached.
   Reveal Solution Discussion Select an answer first