Free SPLK-2003 – Splunk Phantom Certified Admin Practice Test Question

Free demo downloads

Loading demo links...

Showing 4–6 of 10 questions

Question 4

Which of the following is a step when configuring event forwarding from Splunk to Phantom?

Select an option, then click Submit answer.

  • ○

    Map CIM to CEF fields.

  • ○

    Create a Splunk alert that uses the event_forward.py script to send events to Phantom.

  • ○

    Map CEF to CIM fields.

  • ○

    Create a saved search that generates the JSON for the new container on Phantom.

Question 5

When working with complex datapaths, which operator is used to access a sub-element inside another element?

Select an option, then click Submit answer.

  • ○

    !(pipe)

  • ○

    *(asterisk)

  • ○

    :(colon)

  • ○

    .(dot)

Question 6

Within the 12A2 design methodology, which of the following most accurately describes the last step?

Select an option, then click Submit answer.

  • ○

    List of the apps used by the playbook.

  • ○

    List of the actions of the playbook design.

  • ○

    List of the outputs of the playbook design.

  • ○

    List of the data needed to run the playbook.