[Apr 03, 2023] Valid SPLK-2003 Test Answers & SPLK-2003 Exam PDF
Valid Splunk Certification SPLK-2003 Dumps Ensure Your Passing
NEW QUESTION 20
How can an individual asset action be manually started?
- A. By executing a playbook in the Playbooks section.
- B. With the > action button in the analyst queue page.
- C. With the > action button in the Investigation page.
- D. With the > asset button in the asset configuration section.
Answer: C
NEW QUESTION 21
Which of the following is a best practice for use of the global block?
- A. Execute code at the beginning of each run of the playbook.
- B. Execute custom code after each run of the playbook.
- C. Import packages which will be used within the playbook.
- D. Declare outputs which will be selectable within playbook blocks.
Answer: A
NEW QUESTION 22
Which of the following can be configured in the ROl Settings?
- A. Annual analyst salary.
- B. Analyst hours per month.
- C. Number of full time employees (FTEs).
- D. Time lost.
Answer: A
NEW QUESTION 23
Which of the following supported approaches enables Phantom to run on a Windows server?
- A. Install the Phantom RPM in a GNU Cygwin implementation.
- B. Install the Phantom RPM file in Windows Subsystem for Linux (WSL).
- C. Run the Phantom OVA as a virtual machine.
- D. Run the Phantom OVA as a cloud instance.
Answer: D
NEW QUESTION 24
How can a child playbook access the parent playbook's action results?
- A. When configuring the playbook block in the parent, add the desired results in the Scope parameter.
- B. Child playbooks can access parent playbook data while the parent Is still running.
- C. By setting scope to ALL when starting the child.
- D. The parent can create an artifact with the data needed by the did.
Answer: C
NEW QUESTION 25
A user wants to use their Splunk Cloud instance as the external Splunk instance for Phantom. What ports need to be opened on the Splunk Cloud instance to facilitate this? Assume default ports are in use.
- A. Splunk Cloud is not supported.
- B. TCP 80 and TCP 443.
- C. TCP 8080 and TCP 8191.
- D. TCP 8088 and TCP 8099.
Answer: C
NEW QUESTION 26
What is the main purpose of using a customized workbook?
- A. Workbooks guide user activity and coordination during event analysis and case operations.
- B. Workbooks may not be customized; only default workbooks are permitted within Phantom.
- C. Workbooks apply service level agreements (SLAs) to containers and monitor completion status on the ROI dashboard.
- D. Workbooks automatically implement a customized processing of events using Python code.
Answer: B
NEW QUESTION 27
Seventy can be set during ingestion and later changed manually. What other mechanism can change the severity or a container?
- A. Service level agreement (SLA) expiration
- B. Playbooks
- C. Actions
- D. Notes
Answer: C
NEW QUESTION 28
What values can be applied when creating Custom CEF field?
- A. Name
- B. Name, Data Type
- C. Name, Data Type, Severity
- D. Name, Value
Answer: C
NEW QUESTION 29
When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible
- A. Enter the two queries in the asset as comma separated values.
- B. Configure the second query in the Phantom app for Splunk.
- C. Install a second Splunk app and configure the query in the second app.
- D. Configure a second Splunk asset with the second query.
Answer: A
NEW QUESTION 30
When is using decision blocks most useful?
- A. When selecting one (or zero) possible paths in the playbook.
- B. When modifying downstream data hi one or more paths in the playbook.
- C. When evaluating complex, multi-value results or artifacts.
- D. When processing different data in parallel.
Answer: A
NEW QUESTION 31
Is it possible to import external Python libraries such as the time module?
- A. Yes, in the global block.
- B. No.
- C. Yes. from a drop down menu.
- D. No, but this can be changed by setting the proper permissions.
Answer: A
NEW QUESTION 32
Some of the playbooks on the Phantom server should only be executed by members of the admin role. How can this rule be applied?
- A. Place restricted playbooks in a second source repository that has restricted access.
- B. Add a tag with restricted access to the restricted playbooks.
- C. Make sure the Execute Playbook capability is removed from al roles except admin.
- D. Add a filter block to al restricted playbooks that Titters for runRole - "Admin''.
Answer: D
NEW QUESTION 33
After a successful POST to a Phantom REST endpoint to create a new object what result is returned?
- A. The full CEF name.
- B. The new object ID.
- C. The new object name.
- D. The PostGres UUID.
Answer: D
NEW QUESTION 34
Within the 12A2 design methodology, which of the following most accurately describes the last step?
- A. List of the outputs of the playbook design.
- B. List of the apps used by the playbook.
- C. List of the actions of the playbook design.
- D. List of the data needed to run the playbook.
Answer: D
NEW QUESTION 35
What does a user need to do to have a container with an event from Splunk use context-aware actions designed for notable events?
- A. Rename the event_id field from the notable event to splunkNotableEventld.
- B. Include the event_id field in the search results and add a CEF definition to Phantom for event_id, datatype splunk notable event id.
- C. Include the notable event's event_id field and set the artifacts label to aplunk notable event id.
- D. Add a custom field to the container named event_id and set the custom field's data type to splunk notable event id.
Answer: D
NEW QUESTION 36
......
SPLK-2003 Dumps Real Exam Questions Test Engine Dumps Training: https://dumpstorrent.exam4pdf.com/SPLK-2003-dumps-torrent.html
