Free SPLK-2003 Sample Questions — Splunk SOAR Certified Automation Developer

Splunk SOAR Certified Automation Developer (SPLK-2003) is a developer-level Splunk certification exam. The blueprint splits the exam across 5 domains, starting with SOAR Architecture, Playbook Development, Integration and APIs. On exam day you face around 70 questions in 70 minutes, in formats such as multiple-choice. The 10 questions below are free samples written to match that style: answer each one first, then reveal the correct answer and note which topics you miss. The SPLK-2003 is rated hard in difficulty, and most candidates prepare with at least 12 months of hands-on experience. Because every answer is revealed in place, you can work through the whole set without leaving this page. Work through all 10 samples before deciding whether to buy the full 37+ question PDF.

  • 10 free questions
  • 70 min
  • $150 official fee
  • Every free question shows the correct answer
  • Questions follow the official 5-domain blueprint
  • No account or email required
  • 37+ questions in the full PDF

Looking for more? Click here to get the full PDF with 37+ practice questions for $5 for offline study and deeper preparation.

Question 1

To limit the impact of custom code on the VPE, where should the custom code be placed?

  • A. separate container
  • B. separate code repository
  • C. custom function block
  • D. custom container or a separate KV store
Show Answer
Correct Answer:
C. custom function block
Question 2

When the Splunk App for SOAR Export executes a Splunk search, which activities are completed?

  • A. CEF fields are mapped to CIM and a container is created on the Splunk server
  • B. CIM fields are mapped to CEF and a container is created on the Splunk server
  • C. CEF fields are mapped to CIM fields and a container is created on the SOAR server
  • D. CIM fields are mapped to CEF fields and a container is created on the SOAR server
Show Answer
Correct Answer:
D. CIM fields are mapped to CEF fields and a container is created on the SOAR server
Question 3

Splunk user account(s) with which roles must be created to configure SOAR with an external Splunk Enterprise instance?

  • A. phantomsearch, phantomdelete
  • B. phantomcreate, phantomedit
  • C. superuser, administrator
  • D. admin, user
Show Answer
Correct Answer:
A. phantomsearch, phantomdelete
Question 4

Which of the following applies to filter blocks?

  • A. Can select containers by severity or status
  • B. Can select assets by tenant, approver, or app
  • C. Can select which blocks have access to container data
  • D. Can be used to select data for use by other blocks
Show Answer
Correct Answer:
D. Can be used to select data for use by other blocks
Question 5

A user selects the New option under Sources on the menu. What will be displayed?

  • A. list of new assets
  • B. list of new events
  • C. list of new data sources
  • D. The New Data Ingestion wizard
Show Answer
Correct Answer:
B. list of new events
Question 6

How can the DECIDED process be restarted?

  • A. By restarting the automation service
  • B. By restarting the playbook daemon
  • C. In Administration > Server Settings
  • D. On the System Health page
Show Answer
Correct Answer:
D. On the System Health page
Question 7

Which of the following can be done with the System Health Display?

  • A. Partially rewind processes, which is useful for debugging
  • B. Create a temporary, edited version of a process and test the results
  • C. Reset DECIDED to reset playbook environments back to at-start conditions
  • D. View a single column of status for SOAR processes. For metrics, click Details
Show Answer
Correct Answer:
D. View a single column of status for SOAR processes. For metrics, click Details
Question 8

Which visual playbook editor block is used to assemble commands and data into a valid Splunk search within a SOAR playbook?

  • A. An action block
  • B. filter block
  • C. prompt block
  • D. format block
Show Answer
Correct Answer:
C. prompt block
Question 9

What are indicators?

  • A. Artifact values that can appear in multiple containers
  • B. Action results that may appear in multiple containers
  • C. Artifact values with special security significance
  • D. Action result items that determine the flow of execution in a playbook
Show Answer
Correct Answer:
A. Artifact values that can appear in multiple containers
Question 10

Which of the following are tabs of an asset configuration?

  • A. Asset Info, Asset Settings, Approval Settings, Access Control
  • B. Asset Name, Asset IP, Asset URL, Asset Nickname
  • C. Tags, Asset Name, Asset Date, Asset Order
  • D. App Name, App Order, App Expiry, App Version
Show Answer
Correct Answer:
A. Asset Info, Asset Settings, Approval Settings, Access Control

SPLK-2003 sample questions FAQ

Are these SPLK-2003 sample questions from the real exam?

No. They are original practice questions written to match the format and topic mix of the Splunk SOAR Certified Automation Developer exam, which contains around 70 questions. Treat them as representative practice, not leaked exam content.

How many free SPLK-2003 sample questions do I get?

This page includes 10 questions, each with its correct answer you can reveal in place. The full study PDF expands that to 37+ questions.

Do the sample questions include the correct answers?

Yes. Open the answer panel under each question to see which option is correct. Answer first, then reveal, so the set works as a self-check rather than a reading exercise.

Is 10 sample questions enough to pass the SPLK-2003?

Not on its own. Use the samples to find weak topics, revise them against the official domains, then work through the full 37+ question set under timed conditions before booking the exam.

Aced these? Get the Full Exam

Download the complete SPLK-2003 study bundle with 37+ questions in a single printable PDF.

Purchase Full Exam PDF | $5