Splunk SPLK-5001 Exam - Topic 8 Question 30 Discussion

Actual exam question for Splunk's SPLK-5001 exam

Question #: 30
Topic #: 8

While investigating findings in Enterprise Security, an analyst has identified a compromised device. Without leaving ES, what action could they take to run a sequence of containment activities on the compromised device that also updates the original finding?

ARun an event-level workflow action that initiates a SOAR playbook.

BRun a field-level workflow action that initiates a SOAR playbook.

CRun an adaptive response action that initiates a SOAR playbook.

DRun an alert action that initiates a SOAR playbook.

Show Suggested Answer

Suggested Answer: C

by Felicia at Nov 22, 2025, 11:54 AM

Limited Time Offer

25%

Off

Get Premium SPLK-5001 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Zona

9 hours ago

D) just seems like a workaround, not a solid solution.

upvoted 0 times

...

Kiera

6 days ago

Wait, can you really do all that without leaving ES?

upvoted 0 times

...

Malissa

11 days ago

C) sounds right, adaptive responses are key!

upvoted 0 times

...

Jeffrey

16 days ago

I'd go with C) Run an adaptive response action. It's like a superhero cape for your security team - they can swoop in and save the day without ever leaving their desk!

upvoted 0 times

...

Tiera

21 days ago

B) Run a field-level workflow action that initiates a SOAR playbook. Hmm, I'm not sure about this one. Seems a bit too specific compared to the other options.

upvoted 0 times

...

Kaycee

26 days ago

D) Run an alert action that initiates a SOAR playbook. Alerts are designed for these types of situations, so this seems like the logical choice.

upvoted 0 times

...

Jacquelyne

1 month ago

A) Run an event-level workflow action that initiates a SOAR playbook. This would be my choice as it allows the analyst to take action directly from the event details.

upvoted 0 times

...

Freeman

1 month ago

C) Run an adaptive response action that initiates a SOAR playbook. This seems like the most appropriate option to contain the compromised device without leaving the Enterprise Security platform.

upvoted 0 times

...

Jules

1 month ago

I’m torn between A and C. I know SOAR playbooks are important, but I can't recall the exact differences between those workflow actions.

upvoted 0 times

...

Celestina

2 months ago

I feel like D could be a good option since it mentions alerts, but I’m not clear on how that ties into containment activities.

upvoted 0 times

...

Mickie

2 months ago

I remember practicing a similar question where we discussed adaptive responses, so I’m leaning towards C, but I’m not confident.

upvoted 0 times

...

Nieves

2 months ago

I think the answer might be A, but I'm not entirely sure if it specifically mentions event-level actions in the context of containment.

upvoted 0 times

...

Selene

2 months ago

I disagree, B) seems more efficient for field-level actions.

upvoted 0 times

...

Dominga

2 months ago

I'm pretty confident that C is the correct answer. Running an adaptive response action to initiate a SOAR playbook seems like the most straightforward way to handle this situation without leaving Enterprise Security.

upvoted 0 times

...

Margarett

2 months ago

Okay, I've got this. The key is to take an action that initiates a SOAR playbook, so I'd say C is the way to go. Adaptive response sounds like the right approach to contain the compromised device.

upvoted 0 times

...

Nichelle

3 months ago

A) is the best choice for containment.

upvoted 0 times

...

Francoise

3 months ago

I'm leaning towards B. A field-level workflow action might give me more control over the specific actions taken on the compromised device, but I'll need to double-check the details.

upvoted 0 times

...

Dorothy

3 months ago

Hmm, I'm a bit confused. What's the difference between a field-level workflow action and an event-level workflow action? I'm not sure which one to choose.

upvoted 0 times

...

Camellia

3 months ago

I think I'd go with option C. Running an adaptive response action seems like the best way to initiate a SOAR playbook without leaving Enterprise Security.

upvoted 0 times

...