[2023] Pass Key features of SPLK-2003 Course with Updated 60 Questions
SPLK-2003 Sample Practice Exam Questions 2023 Updated Verified
NEW QUESTION # 31
What is the default embedded search engine used by Phantom?
- A. Embedded Splunk search engine.
- B. Embedded Elastic search engine.
- C. Embedded Phantom search engine.
- D. Embedded Django search engine.
Answer: B
NEW QUESTION # 32
Which of the following is the complete list of the types of backups that are supported by Phantom?
- A. Full, delta, and incremental backups.
- B. Full and incremental backups.
- C. Full and delta backups.
- D. Full backups.
Answer: B
NEW QUESTION # 33
Within the 12A2 design methodology, which of the following most accurately describes the last step?
- A. List of the data needed to run the playbook.
- B. List of the actions of the playbook design.
- C. List of the outputs of the playbook design.
- D. List of the apps used by the playbook.
Answer: A
NEW QUESTION # 34
Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment' Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.
- A. Within the UI: Select from the main menu Administration > System Health > Backup.
- B. On the command line enter: rode sudo python ibackup.pyc --setup, then audo phenv python ibackup.pyc
--backup. - C. On the command line enter: sudo phenv python ibackup.pyc --backup -backup-type full, then sudo phenv python ibackup.pyc --setup.
- D. Within the UI: Select from the main menu Administration > Product Settings > Backup.
Answer: C
NEW QUESTION # 35
In this image, which container fields are searched for the text "Malware"?
- A. Event Name and Artifact Names.
- B. Event Name, Notes, Comments.
- C. Event Name or ID.
Answer: A
NEW QUESTION # 36
What values can be applied when creating Custom CEF field?
- A. Name, Data Type, Severity
- B. Name, Data Type
- C. Name, Value
- D. Name
Answer: A
NEW QUESTION # 37
Which of the following describes the use of labels m Phantom?
- A. Labels determine which playbook(s) are executed when a container is created.
- B. Labels control the default seventy, ownership, and sensitivity for the container.
- C. Labels control which apps are allowed to execute actions on the container.
- D. Labels determine the service level agreement (SLA) for a container.
Answer: B
NEW QUESTION # 38
Which Phantom VPE Nock S used to add information to custom lists?
- A. Filter blocks
- B. API blocks
- C. Action blocks
- D. Decision blocks
Answer: B
NEW QUESTION # 39
A user wants to get the playbook results for a single artifact. Which steps will accomplish the?
- A. Use the contextual menu from the artifact and select run playbook.
- B. Use the run playbook dialog and set the scope to the artifact.
- C. Create a new container including Just the artifact in question.
- D. Use the contextual menu from the artifact and select the actions.
Answer: C
NEW QUESTION # 40
When is using decision blocks most useful?
- A. When processing different data in parallel.
- B. When selecting one (or zero) possible paths in the playbook.
- C. When modifying downstream data hi one or more paths in the playbook.
- D. When evaluating complex, multi-value results or artifacts.
Answer: B
NEW QUESTION # 41
Which of the following is a step when configuring event forwarding from Splunk to Phantom?
- A. Map CEF to CIM fields.
- B. Create a saved search that generates the JSON for the new container on Phantom.
- C. Map CIM to CEF fields.
- D. Create a Splunk alert that uses the event_forward.py script to send events to Phantom.
Answer: A
NEW QUESTION # 42
What is the main purpose of using a customized workbook?
- A. Workbooks apply service level agreements (SLAs) to containers and monitor completion status on the ROI dashboard.
- B. Workbooks guide user activity and coordination during event analysis and case operations.
- C. Workbooks automatically implement a customized processing of events using Python code.
- D. Workbooks may not be customized; only default workbooks are permitted within Phantom.
Answer: D
NEW QUESTION # 43
A user wants to use their Splunk Cloud instance as the external Splunk instance for Phantom. What ports need to be opened on the Splunk Cloud instance to facilitate this? Assume default ports are in use.
- A. Splunk Cloud is not supported.
- B. TCP 8080 and TCP 8191.
- C. TCP 80 and TCP 443.
- D. TCP 8088 and TCP 8099.
Answer: B
NEW QUESTION # 44
When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible
- A. Enter the two queries in the asset as comma separated values.
- B. Configure the second query in the Phantom app for Splunk.
- C. Configure a second Splunk asset with the second query.
- D. Install a second Splunk app and configure the query in the second app.
Answer: A
NEW QUESTION # 45
Which app allows a user to run Splunk queries from within Phantom?
- A. Splunk App for Phantom?
- B. Splunk App for Phantom Reporting.
- C. The Integrated Splunk/Phantom app.
- D. Phantom App for Splunk.
Answer: A
NEW QUESTION # 46
Configuring Phantom search to use an external Splunk server provides which of the following benefits?
- A. The ability to run more complex reports on Phantom activities.
- B. The ability to automate Splunk searches within Phantom.
- C. The ability to display results as Splunk dashboards within Phantom.
- D. The ability to ingest Splunk notable events into Phantom.
Answer: B
NEW QUESTION # 47
Which of the following accurately describes the Files tab on the Investigate page?
- A. Files tab items and artifacts are the only data sources that can populate active cases.
- B. A user can upload the output from a detonate action to the the files tab for further investigation.
- C. Phantom memory requirements remain static, regardless of Files tab usage.
- D. Files tab items cannot be added to investigations. Instead, add them to action blocks.
Answer: C
NEW QUESTION # 48
Which Phantom API command is used to create a custom list?
- A. phantom.new_list()
- B. phantom.include_list()
- C. phantom.create_list()
- D. phantom.add_list()
Answer: D
NEW QUESTION # 49
After a playbook has run, where are the results stored?
- A. Log file
- B. Case
- C. Splunk Index
- D. Container
Answer: A
NEW QUESTION # 50
How can the debug log for a playbook execution be viewed?
- A. Click Expand Scope m the debug window.
- B. In Administration > System Health > Playbook Run History, select the playbook execution entry, then select Log.
- C. On the Investigation page, select Debug Log from the playbook's action menu in the Recent Activity panel.
- D. Open the playbook in the Visual Playbook Editor, and select Debug Logs in Settings.
Answer: A
NEW QUESTION # 51
Phantom supports multiple user authentication methods such as LDAP and SAML2. What other user authentication method is supported?
- A. OpenID
- B. PIV/CAC
- C. Biometrics
- D. SAML3
Answer: D
NEW QUESTION # 52
An active playbook can be configured to operate on all containers that share which attribute?
- A. Artifact
- B. Label
- C. Severity
- D. Tag
Answer: B
NEW QUESTION # 53
Which of the following is a best practice for use of the global block?
- A. Execute custom code after each run of the playbook.
- B. Execute code at the beginning of each run of the playbook.
- C. Declare outputs which will be selectable within playbook blocks.
- D. Import packages which will be used within the playbook.
Answer: B
NEW QUESTION # 54
......
The New SPLK-2003 2023 Updated Verified Study Guides & Best Courses: https://www.exam4pdf.com/SPLK-2003-dumps-torrent.html
Exam Study Guide Free Practice Test LAST UPDATED : https://drive.google.com/open?id=1aHkPagYjSpCgITV-p1a_18eqUx1RbBwn
