Splunk SPLK-5001 Exam - Topic 8 Question 30 Discussion

Actual exam question for Splunk's SPLK-5001 exam

Question #: 30
Topic #: 8

While investigating findings in Enterprise Security, an analyst has identified a compromised device. Without leaving ES, what action could they take to run a sequence of containment activities on the compromised device that also updates the original finding?

ARun an event-level workflow action that initiates a SOAR playbook.

BRun a field-level workflow action that initiates a SOAR playbook.

CRun an adaptive response action that initiates a SOAR playbook.

DRun an alert action that initiates a SOAR playbook.

Show Suggested Answer

Suggested Answer: C

by Felicia at Nov 22, 2025, 11:54 AM

Limited Time Offer

25%

Off

Get Premium SPLK-5001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Anisha

2 months ago

C could be effective too. It adapts to the situation well.

upvoted 0 times

...

Helene

2 months ago

A is solid. It allows for a structured response to the incident.

upvoted 0 times

...

Destiny

2 months ago

D sounds good, but I prefer actions that are more comprehensive.

upvoted 0 times

...

Pauline

2 months ago

Option B feels too limited. Field-level actions don’t cover everything.

upvoted 0 times

...

Barney

2 months ago

I’m leaning towards C. Adaptive response seems more flexible.

upvoted 0 times

...

Brice

2 months ago

I think option A is the best choice. It targets the event level directly.

upvoted 0 times

...

Zona

3 months ago

D) just seems like a workaround, not a solid solution.

upvoted 0 times

...

Kiera

3 months ago

Wait, can you really do all that without leaving ES?

upvoted 0 times

...

Malissa

3 months ago

C) sounds right, adaptive responses are key!

upvoted 0 times

...

Jeffrey

4 months ago

I'd go with C) Run an adaptive response action. It's like a superhero cape for your security team - they can swoop in and save the day without ever leaving their desk!

upvoted 0 times

...

Tiera

4 months ago

B) Run a field-level workflow action that initiates a SOAR playbook. Hmm, I'm not sure about this one. Seems a bit too specific compared to the other options.

upvoted 0 times

...

Kaycee

4 months ago

D) Run an alert action that initiates a SOAR playbook. Alerts are designed for these types of situations, so this seems like the logical choice.

upvoted 0 times

...

Jacquelyne

4 months ago

A) Run an event-level workflow action that initiates a SOAR playbook. This would be my choice as it allows the analyst to take action directly from the event details.

upvoted 0 times

...

Freeman

4 months ago

C) Run an adaptive response action that initiates a SOAR playbook. This seems like the most appropriate option to contain the compromised device without leaving the Enterprise Security platform.

upvoted 0 times

...

Jules

4 months ago

I’m torn between A and C. I know SOAR playbooks are important, but I can't recall the exact differences between those workflow actions.

upvoted 0 times

...

Celestina

5 months ago

I feel like D could be a good option since it mentions alerts, but I’m not clear on how that ties into containment activities.

upvoted 0 times

...

Mickie

5 months ago

I remember practicing a similar question where we discussed adaptive responses, so I’m leaning towards C, but I’m not confident.

upvoted 0 times

...

Nieves

5 months ago

I think the answer might be A, but I'm not entirely sure if it specifically mentions event-level actions in the context of containment.

upvoted 0 times

...

Selene

5 months ago

I disagree, B) seems more efficient for field-level actions.

upvoted 0 times

...

Dominga

5 months ago

I'm pretty confident that C is the correct answer. Running an adaptive response action to initiate a SOAR playbook seems like the most straightforward way to handle this situation without leaving Enterprise Security.

upvoted 0 times

...

Margarett

5 months ago

Okay, I've got this. The key is to take an action that initiates a SOAR playbook, so I'd say C is the way to go. Adaptive response sounds like the right approach to contain the compromised device.

upvoted 0 times

...

Nichelle

6 months ago

A) is the best choice for containment.

upvoted 0 times

...

Francoise

6 months ago

I'm leaning towards B. A field-level workflow action might give me more control over the specific actions taken on the compromised device, but I'll need to double-check the details.

upvoted 0 times

...

Dorothy

6 months ago

Hmm, I'm a bit confused. What's the difference between a field-level workflow action and an event-level workflow action? I'm not sure which one to choose.

upvoted 0 times

...

Camellia

6 months ago

I think I'd go with option C. Running an adaptive response action seems like the best way to initiate a SOAR playbook without leaving Enterprise Security.

upvoted 0 times