The intended answer is A because its item parameter contains a JSON array with two separate objects , meaning two new threat-intelligence records are supplied in a single request:
[
{ " src_user " : " user_new " , " subject " : " click this " },
{ " src_user " : " user2_new " , " subject " : " click this " }
]
The surrounding single quotes are also important in a shell because they preserve the JSON ' s internal double quotes. Option C attempts to surround the entire JSON value with double quotes while also using unescaped double quotes inside the JSON, which would break normal shell parsing. Options B and D contain only one object , so they cannot create two rows.
There is one transcription issue worth noting: as pasted, options A and D end with an incomplete -X, and -G changes how cURL submits -d data. In a complete working REST call, the creation request would ordinarily use POST , for example -X POST, or rely on -d to imply POST. Thus A is clearly the intended certification answer based on its two-record JSON payload , although the pasted command ' s trailing flags are incomplete.
The supplied study material covers REST parameters, HTTP POST semantics, and threat-intelligence collections, but not this exact question verbatim.
Study Guide topics: Splunk REST API, Threat Intelligence Framework, JSON arrays, REST payloads, cURL, HTTP POST.
