Get Special Discount Offer of SPLK-2003 Certification Exam Sample Questions and Answers [Q20-Q36]

4.7/5 - (3 votes)

Get Special Discount Offer of SPLK-2003 Certification Exam Sample Questions and Answers

New SPLK-2003 Dumps For Preparing Splunk Certification Certified Splunk Exam Well

QUESTION 20
How can an individual asset action be manually started?

With the > action button in the analyst queue page.

By executing a playbook in the Playbooks section.

With the > action button in the Investigation page.

With the > asset button in the asset configuration section.

QUESTION 21
Which Phantom API command is used to create a custom list?

phantom.add_list()

phantom.create_list()

phantom.include_list()

phantom.new_list()

QUESTION 22
Which of the following are examples of things commonly done with the Phantom REST APP

Use Django queries; use curl to create a container and add artifacts to it; remove temporary lists.

Use Django queries; use Docker to create a container and add artifacts to it; remove temporary lists.

Use Django queries; use curl to create a container and add artifacts to it; add action blocks.

Use SQL queries; use curl to create a container and add artifacts to it; remove temporary lists.

QUESTION 23
Is it possible to import external Python libraries such as the time module?

No.

No, but this can be changed by setting the proper permissions.

Yes, in the global block.

Yes. from a drop down menu.

QUESTION 24
Which of the following supported approaches enables Phantom to run on a Windows server?

Install the Phantom RPM in a GNU Cygwin implementation.

Run the Phantom OVA as a cloud instance.

Install the Phantom RPM file in Windows Subsystem for Linux (WSL).

Run the Phantom OVA as a virtual machine.

QUESTION 25
How can the debug log for a playbook execution be viewed?

On the Investigation page, select Debug Log from the playbook’s action menu in the Recent Activity panel.

Click Expand Scope m the debug window.

In Administration > System Health > Playbook Run History, select the playbook execution entry, then select Log.

Open the playbook in the Visual Playbook Editor, and select Debug Logs in Settings.

QUESTION 26
Which app allows a user to send Splunk Enterprise Security notable events to Phantom?

Any of the integrated Splunk/Phantom Apps

Splunk App for Phantom Reporting.

Splunk App for Phantom.

Phantom App for Splunk.

QUESTION 27
What is enabled if the Logging option for a playbook’s settings is enabled?

More detailed logging information Is available m the Investigation page.

All modifications to the playbook will be written to the audit log.

More detailed information is available in the debug window.

The playbook will write detailed execution information into the spawn.log.

QUESTION 28
An active playbook can be configured to operate on all containers that share which attribute?

Artifact

Label

Tag

Severity

QUESTION 29
Without customizing container status within Phantom, what are the three types of status for a container?

New, In Progress, Closed

Low, Medium, High

Mew, Open, Resolved

Low, Medium, Critical

QUESTION 30
Which of the following is a step when configuring event forwarding from Splunk to Phantom?

Map CIM to CEF fields.

Create a Splunk alert that uses the event_forward.py script to send events to Phantom.

Map CEF to CIM fields.

Create a saved search that generates the JSON for the new container on Phantom.

QUESTION 31
After a playbook has run, where are the results stored?

Splunk Index

Case

Container

Log file

QUESTION 32
Which of the following can the format block be used for?

To generate arrays for input into other functions.

To generate HTML or CSS content for output in email messages, user prompts, or comments.

To generate string parameters for automated action blocks.

To create text strings that merge state text with dynamic values for input or output.

QUESTION 33
A user wants to use their Splunk Cloud instance as the external Splunk instance for Phantom. What ports need to be opened on the Splunk Cloud instance to facilitate this? Assume default ports are in use.

TCP 8088 and TCP 8099.

TCP 80 and TCP 443.

Splunk Cloud is not supported.

TCP 8080 and TCP 8191.

QUESTION 34
What values can be applied when creating Custom CEF field?

Name

Name, Data Type

Name, Value

Name, Data Type, Severity

QUESTION 35
What do assets provide for app functionality?

Assets provide location, credentials, and other parameters needed to run actions.

Assets provide hostnames, passwords, and other artifacts needed to run actions.

Assets provide Python code, REST API, and other capabilities needed to run actions.

Assets provide firewall, network, and data sources needed to run actions.

QUESTION 36
Which of the following are the default ports that must be configured on Splunk to allow connections from Phantom?

SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000)

SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000)

SplunkWeb (8421), SplunkD (8061), HTTP Collector (8798)

SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)

Loading …

Updated SPLK-2003 Dumps Questions Are Available For Passing Splunk Exam: https://www.actualpdf.com/SPLK-2003_exam-dumps.html

Leave a Reply Cancel reply