Splunk IT Service Intelligence Certified Admin Free Practice Exam Questions

37 real Splunk IT Service Intelligence Certified Admin exam questions with answers and AI explanations. Splunk certification prep — page 3 of 4.

1. Question 21: What is the default log level for system health debug logs?
2. Question 22: Which visual playbook editor block is used to assemble commands and data into a valid Splunk search within a SOAR playbook?
3. Question 23: During a second test of a playbook, a user receives an error that states: "an empty parameters list was passed to phantom.act()." What does this indicate?
4. Question 24: Which of the following are the default ports that must be configured on Splunk to allow connections from SOAR?
5. Question 25: An active playbook can be configured to operate on all containers that share which attribute?
6. Question 26: Under Asset Ingestion Settings, how many labels must be applied when configuring an asset?
7. Question 27: To limit the impact of custom code on the VPE, where should the custom code be placed?
8. Question 28: Some of the playbooks on the SOAR server should only be executed by members of the admin role. How can this rule be applied?
9. Question 29: A user selects the New option under Sources on the menu. What will be displayed?
10. Question 30: When the Splunk App for SOAR Export executes a Splunk search, which activities are completed?