Splunk SPLK-2003 Practice Questions| TestInsights

Question 1

A user wants to get the playbook results for a single artifact. Which steps will accomplish the?

AUse the contextual menu from the artifact and select run playbook.

BUse the run playbook dialog and set the scope to the artifact.

CCreate a new container including Just the artifact in question.

DUse the contextual menu from the artifact and select the actions.

Correct : C

Options Selected by Other Users:

Mark Question:

Start a Discussions

Submit Your Answer:

AUse the contextual menu from the artifact and select run playbook.

BUse the run playbook dialog and set the scope to the artifact.

CCreate a new container including Just the artifact in question.

DUse the contextual menu from the artifact and select the actions.

Question 2

What is the main purpose of using a customized workbook?

AWorkbooks automatically implement a customized processing of events using Python code.

BWorkbooks guide user activity and coordination during event analysis and case operations.

CWorkbooks apply service level agreements (SLAs) to containers and monitor completion status on the ROI dashboard.

DWorkbooks may not be customized; only default workbooks are permitted within Phantom.

Correct : D

Options Selected by Other Users:

Mark Question:

Start a Discussions

Submit Your Answer:

AWorkbooks automatically implement a customized processing of events using Python code.

BWorkbooks guide user activity and coordination during event analysis and case operations.

CWorkbooks apply service level agreements (SLAs) to containers and monitor completion status on the ROI dashboard.

DWorkbooks may not be customized; only default workbooks are permitted within Phantom.

Question 3

Which of the following is a step when configuring event forwarding from Splunk to Phantom?

AMap CIM to CEF fields.

BCreate a Splunk alert that uses the event_forward.py script to send events to Phantom.

CMap CEF to CIM fields.

DCreate a saved search that generates the JSON for the new container on Phantom.

Correct : C

Options Selected by Other Users:

Mark Question:

Start a Discussions

Submit Your Answer:

AMap CIM to CEF fields.

BCreate a Splunk alert that uses the event_forward.py script to send events to Phantom.

CMap CEF to CIM fields.

DCreate a saved search that generates the JSON for the new container on Phantom.

Question 4

Which is the primary system requirement that should be increased with heavy usage of the file vault?

AAmount of memory.

BNumber of processors.

CAmount of storage.

DBandwidth of network.

Correct : C

Options Selected by Other Users:

Mark Question:

Start a Discussions

Submit Your Answer:

AAmount of memory.

BNumber of processors.

CAmount of storage.

DBandwidth of network.

Question 5

When is using decision blocks most useful?

AWhen selecting one (or zero) possible paths in the playbook.

BWhen processing different data in parallel.

CWhen evaluating complex, multi-value results or artifacts.

DWhen modifying downstream data hi one or more paths in the playbook.

Correct : A

Options Selected by Other Users:

Mark Question:

Start a Discussions

Submit Your Answer:

AWhen selecting one (or zero) possible paths in the playbook.

BWhen processing different data in parallel.

CWhen evaluating complex, multi-value results or artifacts.

DWhen modifying downstream data hi one or more paths in the playbook.

Curious about Actual Splunk SOAR Certified Automation Developer (SPLK-2003) Exam Questions?

Options Selected by Other Users:

Options Selected by Other Users:

Options Selected by Other Users:

Options Selected by Other Users:

Options Selected by Other Users: