[Aug 20, 2022] Free Splunk Certification SPLK-2003 Exam Question
SPLK-2003 dumps & Splunk Certification sure practice dumps
NEW QUESTION 19
When is using decision blocks most useful?
- A. When selecting one (or zero) possible paths in the playbook.
- B. When processing different data in parallel.
- C. When modifying downstream data hi one or more paths in the playbook.
- D. When evaluating complex, multi-value results or artifacts.
Answer: A
NEW QUESTION 20
What is enabled if the Logging option for a playbook's settings is enabled?
- A. All modifications to the playbook will be written to the audit log.
- B. More detailed logging information Is available m the Investigation page.
- C. The playbook will write detailed execution information into the spawn.log.
- D. More detailed information is available in the debug window.
Answer: C
NEW QUESTION 21
Which Phantom VPE Nock S used to add information to custom lists?
- A. Decision blocks
- B. API blocks
- C. Filter blocks
- D. Action blocks
Answer: B
NEW QUESTION 22
Which of the following is the complete list of the types of backups that are supported by Phantom?
- A. Full backups.
- B. Full and delta backups.
- C. Full, delta, and incremental backups.
- D. Full and incremental backups.
Answer: D
NEW QUESTION 23
When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible
- A. Configure a second Splunk asset with the second query.
- B. Enter the two queries in the asset as comma separated values.
- C. Configure the second query in the Phantom app for Splunk.
- D. Install a second Splunk app and configure the query in the second app.
Answer: B
NEW QUESTION 24
Which app allows a user to run Splunk queries from within Phantom?
- A. Phantom App for Splunk.
- B. Splunk App for Phantom Reporting.
- C. The Integrated Splunk/Phantom app.
- D. Splunk App for Phantom?
Answer: D
NEW QUESTION 25
What is the main purpose of using a customized workbook?
- A. Workbooks may not be customized; only default workbooks are permitted within Phantom.
- B. Workbooks automatically implement a customized processing of events using Python code.
- C. Workbooks apply service level agreements (SLAs) to containers and monitor completion status on the ROI dashboard.
- D. Workbooks guide user activity and coordination during event analysis and case operations.
Answer: A
NEW QUESTION 26
Phantom supports multiple user authentication methods such as LDAP and SAML2. What other user authentication method is supported?
- A. Biometrics
- B. PIV/CAC
- C. OpenID
- D. SAML3
Answer: D
NEW QUESTION 27
During a second test of a playbook, a user receives an error that states: 'an empty parameters list was passed to phantom.act()." What does this indicate?
- A. The container has artifacts not parameters.
- B. The playbook debugger's scope is set to new.
- C. The playbook is using an incorrect container.
- D. The playbook debugger's scope is set to all.
Answer: A
NEW QUESTION 28
Which Phantom API command is used to create a custom list?
- A. phantom.new_list()
- B. phantom.add_list()
- C. phantom.create_list()
- D. phantom.include_list()
Answer: B
NEW QUESTION 29
After a playbook has run, where are the results stored?
- A. Splunk Index
- B. Container
- C. Case
- D. Log file
Answer: D
NEW QUESTION 30
Which of the following can be configured in the ROl Settings?
- A. Time lost.
- B. Annual analyst salary.
- C. Analyst hours per month.
- D. Number of full time employees (FTEs).
Answer: B
NEW QUESTION 31
Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?
- A. superuser, administrator
- B. admin,user
- C. phantomcreate. phantomedit
- D. phantomsearch, phantomdelete
Answer: A
NEW QUESTION 32
A customer wants to design a modular and reusable set of playbooks that all communicate with each other.
Which of the following is a best practice for data sharing across playbooks?
- A. Create artifacts using one playbook and collect those artifacts in another playbook.
- B. Use the Handle method to pass data directly between playbooks.
- C. Cal the child playbooks getter function.
- D. Use the py-postgresq1 module to directly save the data in the Postgres database.
Answer: D
NEW QUESTION 33
An active playbook can be configured to operate on all containers that share which attribute?
- A. Severity
- B. Label
- C. Artifact
- D. Tag
Answer: B
NEW QUESTION 34
Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment' Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.
- A. Within the UI: Select from the main menu Administration > Product Settings > Backup.
- B. On the command line enter: rode sudo python ibackup.pyc --setup, then audo phenv python ibackup.pyc
--backup. - C. On the command line enter: sudo phenv python ibackup.pyc --backup -backup-type full, then sudo phenv python ibackup.pyc --setup.
- D. Within the UI: Select from the main menu Administration > System Health > Backup.
Answer: C
NEW QUESTION 35
Seventy can be set during ingestion and later changed manually. What other mechanism can change the severity or a container?
- A. Notes
- B. Service level agreement (SLA) expiration
- C. Playbooks
- D. Actions
Answer: D
NEW QUESTION 36
Configuring Phantom search to use an external Splunk server provides which of the following benefits?
- A. The ability to display results as Splunk dashboards within Phantom.
- B. The ability to run more complex reports on Phantom activities.
- C. The ability to ingest Splunk notable events into Phantom.
- D. The ability to automate Splunk searches within Phantom.
Answer: D
NEW QUESTION 37
A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?
- A. Non-null IP addresses
- B. Null values
- C. Non-null destinationAddresses
- D. Null IP addresses
Answer: B
NEW QUESTION 38
What are indicators?
- A. Action results that may appear in multiple containers.
- B. Artifact values with special security significance.
- C. Action result items that determine the flow of execution in a playbook.
- D. Artifact values that can appear in multiple containers.
Answer: D
NEW QUESTION 39
......
Splunk SPLK-2003 Actual Questions and Braindumps: https://lead2pass.troytecdumps.com/SPLK-2003-troytec-exam-dumps.html