Splunk SOAR Certified Automation Developer — Question 53

Which of the following statements is accurate when using multiple policies?

Answer options

• A. Policy processing is applied in a defined order.
• B. New policies are applied after the default policy.
• C. An event can be processed by only a single policy.
• D. New policies are applied before the default policy.

Correct answer: D

Explanation

The correct answer is D because new policies are indeed prioritized and applied before the default policy. Option A is incorrect as it does not specify that the order favors new policies. Option B is wrong because it contradicts the established order of policy application, and option C is not accurate since multiple policies can apply to the same event.