What is the cause of this behavior?

A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes.

What is the cause of this behavior?
A . Incorrect Join configuration on the second playbook.
B . The first playbook is performing poorly.
C . The steep option for the second playbook is not set to a long enough interval.
D . Synchronous execution has not been configured.

View Answer

Answer: D

Explanation:

The correct answer is D because synchronous execution has not been configured. Synchronous execution is a feature that allows you to control the order of execution of playbook blocks. By default, Phantom executes playbook blocks asynchronously, meaning that it does not wait for one block to finish before starting the next one. This can cause problems when you have dependencies between blocks or when you call other playbooks. To enable synchronous execution, you need to use the sync action in the run playbook block and specify the name of the next block to run after the called playbook completes. See Splunk SOAR Documentation for more details.

In Splunk SOAR, playbooks can be executed either synchronously or asynchronously. Synchronous execution ensures that a playbook waits for a called playbook to complete before proceeding to the next step. If the second playbook starts executing before the first one completes, it indicates that synchronous execution was not configured for the playbooks. Without synchronous execution, playbooks will execute independently of each other’s completion status, leading to potential overlaps in execution. This behavior can be controlled by properly configuring the playbook execution settings to ensure that dependent playbooks complete their tasks in the desired order.