All Obstacles During SPLK-2003 Exam Preparation with SPLK-2003 Real Test Questions
Fully Updated Free Actual Splunk SPLK-2003 Exam Questions
NEW QUESTION 29
Which of the following are the default ports that must be configured on Splunk to allow connections from Phantom?
- A. SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)
- B. SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000)
- C. SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000)
- D. SplunkWeb (8421), SplunkD (8061), HTTP Collector (8798)
Answer: A
NEW QUESTION 30
What is the main purpose of using a customized workbook?
- A. Workbooks automatically implement a customized processing of events using Python code.
- B. Workbooks apply service level agreements (SLAs) to containers and monitor completion status on the ROI dashboard.
- C. Workbooks guide user activity and coordination during event analysis and case operations.
- D. Workbooks may not be customized; only default workbooks are permitted within Phantom.
Answer: D
NEW QUESTION 31
Which of the following is the complete list of the types of backups that are supported by Phantom?
- A. Full and incremental backups.
- B. Full backups.
- C. Full and delta backups.
- D. Full, delta, and incremental backups.
Answer: A
NEW QUESTION 32
Which Phantom VPE Nock S used to add information to custom lists?
- A. Action blocks
- B. API blocks
- C. Decision blocks
- D. Filter blocks
Answer: B
NEW QUESTION 33
An active playbook can be configured to operate on all containers that share which attribute?
- A. Artifact
- B. Label
- C. Tag
- D. Severity
Answer: B
NEW QUESTION 34
Phantom supports multiple user authentication methods such as LDAP and SAML2. What other user authentication method is supported?
- A. PIV/CAC
- B. OpenID
- C. Biometrics
- D. SAML3
Answer: D
NEW QUESTION 35
What is the simplest way to pass data between playbooks?
- A. Action results
- B. Artifacts
- C. File system
- D. KV Store
Answer: C
NEW QUESTION 36
Which is the primary system requirement that should be increased with heavy usage of the file vault?
- A. Bandwidth of network.
- B. Amount of memory.
- C. Number of processors.
- D. Amount of storage.
Answer: D
NEW QUESTION 37
Some of the playbooks on the Phantom server should only be executed by members of the admin role. How can this rule be applied?
- A. Place restricted playbooks in a second source repository that has restricted access.
- B. Make sure the Execute Playbook capability is removed from al roles except admin.
- C. Add a filter block to al restricted playbooks that Titters for runRole - "Admin''.
- D. Add a tag with restricted access to the restricted playbooks.
Answer: C
NEW QUESTION 38
How does a user determine which app actions are available?
- A. Add an action block to a playbook canvas area.
- B. In the visual playbook editor, click Active and click the Available App Actions dropdown.
- C. Search the Apps category in the global search field.
- D. From the Apps menu, click the supported actions dropdown for each app.
Answer: C
NEW QUESTION 39
In addition to full backups. Phantom supports what other backup type using backup?
- A. Partial
- B. Snapshot
- C. Incremental
- D. Differential
Answer: C
NEW QUESTION 40
How can an individual asset action be manually started?
- A. With the > action button in the Investigation page.
- B. With the > asset button in the asset configuration section.
- C. By executing a playbook in the Playbooks section.
- D. With the > action button in the analyst queue page.
Answer: A
NEW QUESTION 41
Which of the following expressions will output debug information to the debug window in the Visual Playbook Editor?
- A. phantom.exception()
- B. phantom.assert()
- C. phantom.debug()
- D. phantom.print ()
Answer: B
NEW QUESTION 42
What are indicators?
- A. Artifact values with special security significance.
- B. Action result items that determine the flow of execution in a playbook.
- C. Artifact values that can appear in multiple containers.
- D. Action results that may appear in multiple containers.
Answer: C
NEW QUESTION 43
What are the differences between cases and events?
- A. Cases: only include high-level incident artifacts.
Events: only include low-level incident artifacts. - B. Case: potential threats.
Events: identified as a specific kind of problem and need a structured approach. - C. Cases: incidents with a known violation and a plan for correction.
Events: occurrences in the system that may require a response. - D. Cases: contain a collection of containers.
Events: contain potential threats.
Answer: B
NEW QUESTION 44
How is it possible to evaluate user prompt results?
- A. Add a decision Mode
- B. Set action_result.summary. status to required.
- C. Set action_result. summary. response to required.
- D. Set the user prompt to reinvoke if it times out.
Answer: D
NEW QUESTION 45
Seventy can be set during ingestion and later changed manually. What other mechanism can change the severity or a container?
- A. Notes
- B. Service level agreement (SLA) expiration
- C. Playbooks
- D. Actions
Answer: D
NEW QUESTION 46
Which of the following describes the use of labels m Phantom?
- A. Labels control which apps are allowed to execute actions on the container.
- B. Labels control the default seventy, ownership, and sensitivity for the container.
- C. Labels determine the service level agreement (SLA) for a container.
- D. Labels determine which playbook(s) are executed when a container is created.
Answer: B
NEW QUESTION 47
Which of the following accurately describes the Files tab on the Investigate page?
- A. Files tab items and artifacts are the only data sources that can populate active cases.
- B. Phantom memory requirements remain static, regardless of Files tab usage.
- C. Files tab items cannot be added to investigations. Instead, add them to action blocks.
- D. A user can upload the output from a detonate action to the the files tab for further investigation.
Answer: B
NEW QUESTION 48
Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment' Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.
- A. Within the UI: Select from the main menu Administration > Product Settings > Backup.
- B. Within the UI: Select from the main menu Administration > System Health > Backup.
- C. On the command line enter: sudo phenv python ibackup.pyc --backup -backup-type full, then sudo phenv python ibackup.pyc --setup.
- D. On the command line enter: rode sudo python ibackup.pyc --setup, then audo phenv python ibackup.pyc
--backup.
Answer: C
NEW QUESTION 49
Within the 12A2 design methodology, which of the following most accurately describes the last step?
- A. List of the data needed to run the playbook.
- B. List of the apps used by the playbook.
- C. List of the outputs of the playbook design.
- D. List of the actions of the playbook design.
Answer: A
NEW QUESTION 50
How can a child playbook access the parent playbook's action results?
- A. When configuring the playbook block in the parent, add the desired results in the Scope parameter.
- B. By setting scope to ALL when starting the child.
- C. The parent can create an artifact with the data needed by the did.
- D. Child playbooks can access parent playbook data while the parent Is still running.
Answer: B
NEW QUESTION 51
......
Validate your SPLK-2003 Exam Preparation with SPLK-2003 Practice Test: https://www.guidetorrent.com/SPLK-2003-pdf-free-download.html
Free SPLK-2003 Questions for Splunk SPLK-2003 Exam [Aug-2022]: https://drive.google.com/open?id=1ZeAqAUiohzxDDBly0CBolR5RuBWdCrcG