Pass SPLK-2003 Exam with Updated SPLK-2003 Exam Dumps PDF 2022
SPLK-2003 Exam Dumps - Free Demo & 365 Day Updates
NEW QUESTION 14
Which app allows a user to send Splunk Enterprise Security notable events to Phantom?
- A. Splunk App for Phantom.
- B. Any of the integrated Splunk/Phantom Apps
- C. Phantom App for Splunk.
- D. Splunk App for Phantom Reporting.
Answer: B
NEW QUESTION 15
Configuring Phantom search to use an external Splunk server provides which of the following benefits?
- A. The ability to ingest Splunk notable events into Phantom.
- B. The ability to automate Splunk searches within Phantom.
- C. The ability to run more complex reports on Phantom activities.
- D. The ability to display results as Splunk dashboards within Phantom.
Answer: B
NEW QUESTION 16
Which of the following expressions will output debug information to the debug window in the Visual Playbook Editor?
- A. phantom.print ()
- B. phantom.exception()
- C. phantom.assert()
- D. phantom.debug()
Answer: C
NEW QUESTION 17
Which of the following is a step when configuring event forwarding from Splunk to Phantom?
- A. Map CEF to CIM fields.
- B. Create a Splunk alert that uses the event_forward.py script to send events to Phantom.
- C. Create a saved search that generates the JSON for the new container on Phantom.
- D. Map CIM to CEF fields.
Answer: A
NEW QUESTION 18
What is the main purpose of using a customized workbook?
- A. Workbooks guide user activity and coordination during event analysis and case operations.
- B. Workbooks automatically implement a customized processing of events using Python code.
- C. Workbooks may not be customized; only default workbooks are permitted within Phantom.
- D. Workbooks apply service level agreements (SLAs) to containers and monitor completion status on the ROI dashboard.
Answer: C
NEW QUESTION 19
Which of the following is the complete list of the types of backups that are supported by Phantom?
- A. Full and incremental backups.
- B. Full and delta backups.
- C. Full, delta, and incremental backups.
- D. Full backups.
Answer: A
NEW QUESTION 20
Which of the following supported approaches enables Phantom to run on a Windows server?
- A. Install the Phantom RPM file in Windows Subsystem for Linux (WSL).
- B. Install the Phantom RPM in a GNU Cygwin implementation.
- C. Run the Phantom OVA as a virtual machine.
- D. Run the Phantom OVA as a cloud instance.
Answer: D
NEW QUESTION 21
A user wants to use their Splunk Cloud instance as the external Splunk instance for Phantom. What ports need to be opened on the Splunk Cloud instance to facilitate this? Assume default ports are in use.
- A. TCP 80 and TCP 443.
- B. TCP 8088 and TCP 8099.
- C. TCP 8080 and TCP 8191.
- D. Splunk Cloud is not supported.
Answer: C
NEW QUESTION 22
What is the simplest way to pass data between playbooks?
- A. KV Store
- B. File system
- C. Artifacts
- D. Action results
Answer: B
NEW QUESTION 23
Some of the playbooks on the Phantom server should only be executed by members of the admin role. How can this rule be applied?
- A. Make sure the Execute Playbook capability is removed from al roles except admin.
- B. Place restricted playbooks in a second source repository that has restricted access.
- C. Add a tag with restricted access to the restricted playbooks.
- D. Add a filter block to al restricted playbooks that Titters for runRole - "Admin''.
Answer: D
NEW QUESTION 24
What is the default embedded search engine used by Phantom?
- A. Embedded Splunk search engine.
- B. Embedded Elastic search engine.
- C. Embedded Phantom search engine.
- D. Embedded Django search engine.
Answer: B
NEW QUESTION 25
Which of the following can be configured in the ROl Settings?
- A. Number of full time employees (FTEs).
- B. Annual analyst salary.
- C. Time lost.
- D. Analyst hours per month.
Answer: B
NEW QUESTION 26
How can an individual asset action be manually started?
- A. With the > action button in the analyst queue page.
- B. With the > asset button in the asset configuration section.
- C. By executing a playbook in the Playbooks section.
- D. With the > action button in the Investigation page.
Answer: D
NEW QUESTION 27
Phantom supports multiple user authentication methods such as LDAP and SAML2. What other user authentication method is supported?
- A. OpenID
- B. SAML3
- C. Biometrics
- D. PIV/CAC
Answer: B
NEW QUESTION 28
A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes. What is the cause of this behavior?
- A. The steep option for the second playbook is not set to a long enough interval.
- B. The first playbook is performing poorly.
- C. Incorrect Join configuration on the second playbook.
- D. Synchronous execution has not been configured.
Answer: C
NEW QUESTION 29
How can a child playbook access the parent playbook's action results?
- A. By setting scope to ALL when starting the child.
- B. The parent can create an artifact with the data needed by the did.
- C. Child playbooks can access parent playbook data while the parent Is still running.
- D. When configuring the playbook block in the parent, add the desired results in the Scope parameter.
Answer: A
NEW QUESTION 30
Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment' Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.
- A. On the command line enter: rode sudo python ibackup.pyc --setup, then audo phenv python ibackup.pyc
--backup. - B. On the command line enter: sudo phenv python ibackup.pyc --backup -backup-type full, then sudo phenv python ibackup.pyc --setup.
- C. Within the UI: Select from the main menu Administration > System Health > Backup.
- D. Within the UI: Select from the main menu Administration > Product Settings > Backup.
Answer: B
NEW QUESTION 31
What values can be applied when creating Custom CEF field?
- A. Name, Data Type
- B. Name
- C. Name, Data Type, Severity
- D. Name, Value
Answer: C
NEW QUESTION 32
Which of the following describes the use of labels m Phantom?
- A. Labels control the default seventy, ownership, and sensitivity for the container.
- B. Labels determine which playbook(s) are executed when a container is created.
- C. Labels control which apps are allowed to execute actions on the container.
- D. Labels determine the service level agreement (SLA) for a container.
Answer: A
NEW QUESTION 33
Within the 12A2 design methodology, which of the following most accurately describes the last step?
- A. List of the apps used by the playbook.
- B. List of the actions of the playbook design.
- C. List of the outputs of the playbook design.
- D. List of the data needed to run the playbook.
Answer: D
NEW QUESTION 34
......
SPLK-2003 Dumps - Pass Your Certification Exam: https://www.braindumpspass.com/Splunk/SPLK-2003-practice-exam-dumps.html
Free Sales Ending Soon - Use Real SPLK-2003 PDF Questions: https://drive.google.com/open?id=1y_vo80CHCW35VOjqATyOEyOAoP64zQQA
