Objective 4.4
Cybersecurity Defense EngineerAutomate responses using SOAR playbooks
Objective 4.4 sits in Automation and Efficiency, which carries 20% of the Cybersecurity Defense Engineer exam. The questions below are original, written from the official objective title above, and each explanation cites the Splunk page it rests on.
Objective title verbatim from the official objectives. Splunk exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A SOAR workflow must query a firewall, then a threat feed, then send a notification, without anyone writing code. How is that playbook built in the editor?
Correct.
Checked against help.splunk.com, August 2026Concept
A playbook is a graph of actions that installed integrations already expose. That is why the available steps depend on which apps are configured.
Why C
Splunk documents linking together a series of actions provided by apps, in a visual editor that does not require writing code.
Source
Splunk Docs: Create playbooks in Splunk SOAR, checked August 2026To define a workflow that you want to automate, link together a series of actions that are provided by apps. An app is third-party software integrated with Splunk SOAR.
Now you: objective 4.4 questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
A playbook author cannot find a block to quarantine an endpoint, though other blocks exist for firewalls. What determines which actions are available?
Sample question 2 of 3
An engineer sets up an automation rule in Enterprise Security. Which playbook type does Splunk document it works with?
Sample question 3 of 3
An engineer tries to add a detection to a second automation rule. What does Splunk document?
Full Cybersecurity Defense Engineer question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.