MENU
Some of the playbooks on the SOAR server should only be executed by members of the admin role. How can this rule be applied?
Suggested Answer: A
Get Premium SPLK-2003 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
To restrict playbook execution to members of the admin role within Splunk SOAR, the 'Execute Playbook' capability must be managed appropriately. This is done by ensuring that this capability is removed from all other roles except the admin role. Role-based access control (RBAC) in Splunk SOAR allows for granular permissions, which means you can configure which roles have the ability to execute playbooks, and by restricting this capability, you can control which users are able to initiate playbook runs.
43 comments · newest first
NI
Nieves
10 months ago
C sounds interesting, but is it really foolproof?
TO
Torie
10 months ago
Totally agree with A, makes it straightforward!
RO
Royal
10 months ago
I think B could work too, but it seems more complicated.
EL
Elli
10 months ago
Really? Can we trust everyone to follow that rule?
KA
Katina
11 months ago
Option A is the best way to go!
AN
Anglea
11 months ago
I feel like option D could work too, but I'm not sure how effective just tagging would be in actually enforcing access control.
HA
Haley
11 months ago
I'm a bit confused about option B; placing playbooks in a second repository sounds secure, but would that really prevent admins from executing them?
WA
Wava
11 months ago
I remember practicing a similar question where we discussed using filters, so option C could also be a valid approach to restrict access based on roles.
MI
Micheal
12 months ago
I think option A makes the most sense since it directly removes the execute capability from other roles, but I'm not entirely sure if that's the only way to enforce it.
LA
Laura
12 months ago
I'm confident that option C is the right choice here. Adding the filter block to check the user's role is a clean and effective way to restrict access to the sensitive playbooks. The other options don't seem as elegant or comprehensive.
BR
Brock
12 months ago
Option A seems too broad - removing the Execute Playbook capability from all roles except admin could have unintended consequences. I like the targeted approach of option C with the filter block. That seems like the most robust solution.
LE
Lezlie
1 year ago
Hmm, I'm a bit unsure about this one. I'm trying to decide between options B and C. Placing the restricted playbooks in a separate repository could work, but the filter block in option C seems more flexible. I'll have to think this through a bit more.
GI
Giuseppe
1 year ago
This seems like a straightforward access control question. I think option C is the best approach - adding a filter block to the restricted playbooks to check the user's role.
PE
Pedro
1 year ago
Option C is the way forward, no doubt. Gotta keep those playbooks in the hands of the chosen few, am I right?
KA
Karima
1 year ago
C) Add a filter block to all restricted playbooks that filters for runRole = 'Admin'.
BA
Bambi
1 year ago
A) Make sure the Execute Playbook capability is removed from all roles except admin.
DE
Dean
1 year ago
C) Add a filter block to all restricted playbooks that filters for runRole = 'Admin'.
SH
Shalon
1 year ago
I see both points, but I personally prefer option B. Keeping restricted playbooks in a separate repository adds an extra layer of security.
OR
Orville
1 year ago
I disagree, I think option C is more secure. Adding a filter block directly to the playbooks is more foolproof.
NA
Nana
1 year ago
I think option A is the best choice. It ensures that only admins can execute the playbooks.
AL
Allene
1 year ago
I bet the admin role has a secret handshake or something. Option C is the way to keep those playbooks on lockdown.
LE
Lelia
1 year ago
Definitely, it's important to have measures in place to control who can run certain playbooks.
LU
Luisa
1 year ago
Yeah, adding a filter block for runRole = 'Admin' seems like a secure way to restrict access.
FE
Fernanda
1 year ago
I agree, option C sounds like the best way to ensure only admins can execute those playbooks.
OC
Ocie
1 year ago
Ah, the admin role strikes again! Option C is definitely the way to go. Can't have the regular folks messing with the important stuff, right?
LI
Lisha
1 year ago
Hmm, I'm not sure about option B. Keeping restricted playbooks in a separate repo seems a bit complex. I'd go with C - the filter block is a straightforward solution.
LI
Lizbeth
1 year ago
True, it depends on the specific requirements of the organization.
EL
Ellsworth
1 year ago
That could work too, but I think the filter block is more specific.
LA
Laquanda
1 year ago
But wouldn't removing the Execute Playbook capability from non-admin roles also work?
WI
Wilford
1 year ago
I agree, option C seems like the simplest solution.
TA
Tawny
1 year ago
I see your point. It's important to have a clear restriction in place.
AL
Alesia
1 year ago
True, but adding a filter block ensures only admins can run the playbooks.
CO
Corinne
1 year ago
But wouldn't removing the Execute Playbook capability work as well?
RU
Ruthann
1 year ago
I agree, option C seems like the simplest solution.
GE
Gennie
2 years ago
Option C looks like the way to go. Filtering for the admin role is a solid approach to ensure only the right people can execute those playbooks.
KA
Katie
1 year ago
True, adding a tag with restricted access could also help in controlling who can execute those playbooks.
ER
Erin
1 year ago
That could work too, but adding a filter block seems more specific to the restricted playbooks.
LI
Lilli
1 year ago
But wouldn't it be easier to just remove the Execute Playbook capability from all roles except admin?
AD
Adrianna
1 year ago
I agree, filtering for the admin role is a good way to restrict access.
SH
Sheron
1 year ago
True, adding a tag for restricted access could also help in controlling who can execute the playbooks.
DI
Diego
1 year ago
That could work too, but filtering seems more specific to the admin role.
NI
Nichelle
1 year ago
But wouldn't removing the Execute Playbook capability from non-admin roles also work?
CA
Cathern
1 year ago
I agree, filtering for the admin role is a good way to restrict access.