Explanation
The correct answer is A because to have a container with an event from Splunk use context-aware actions designed for notable events, you need to include the notable event's event_id field and set the artifact's label to splunk notable event id. Context-aware actions are actions that are specific to a certain type of artifact, such as Splunk notable events, Jira tickets, ServiceNow incidents, etc. To use context-aware actions, you need to label the artifacts with the appropriate type and include the required fields. For Splunk notable events, the required field is event_id, which is the unique identifier of the event in Splunk. See Splunk SOAR Documentation for more details.

Explanation
The correct answer is C because the global block can be used to import packages that will be used within the playbook. This can be useful for importing external libraries or custom modules that provide additional functionality or logic for the playbook. The answer A is incorrect because the global block cannot be used to execute code at the beginning of each run of the playbook, as the global block is only executed once when the playbook is loaded. The answer B is incorrect because the global block cannot be used to declare outputs that will be selectable within playbook blocks, as the outputs are declared in the individual blocks that produce them. The answer D is incorrect because the global block cannot be used to execute custom code after each run of the playbook, as the global block is only executed once when the playbook is loaded. Reference: Splunk SOAR Playbook Development Guide, page 34.

Explanation
The correct answer is A because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is the new object ID. The object ID is a unique identifier for each object in Phantom, such as a container, an artifact, an action, or a playbook. The object ID can be used to retrieve, update, or delete the object using the Phantom REST API. The answer B is incorrect because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is not the new object name, which is a human-readable name for the object. The object name can be used to search for the object using the Phantom web interface. The answer C is incorrect because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is not the full CEF name, which is a standard format for event data. The full CEF name can be used to access the CEF fields of an artifact using the Phantom REST API. The answer D is incorrect because after a successful POST to a Phantom REST endpoint to create a new object, the result returned is not the PostGres UUID, which is a unique identifier for each row in a PostGres database. The PostGres UUID is not exposed to the Phantom REST API. Reference: Splunk SOAR REST API Guide, page
17.

Explanation
A step when configuring event forwarding from Splunk to Phantom is to create a Splunk alert that uses the event_forward.py script to send events to Phantom. This script will convert the Splunk events to CEF format and send them to Phantom as containers. The other options are not valid steps for event forwarding.
See Forwarding events from Splunk to Phantom for more details.

Explanation
Decision blocks are most useful when selecting one (or zero) possible paths in the playbook. Decision blocks allow the user to define one or more conditions based on action results, artifacts, or custom expressions, and execute the corresponding path if the condition is met. If none of the conditions are met, the playbook execution ends. Decision blocks are not used for processing different data in parallel, evaluating complex, multi-value results or artifacts, or modifying downstream data in one or more paths in the playbook. Reference, page 15.