Free SPLK-2003 – Splunk Phantom Certified Admin Practice Test Question

Select an option, then click Submit answer.

• ○

  To generate arrays for input into other functions.

• ○

  To generate HTML or CSS content for output in email messages, user prompts, or comments.

• ○

  To generate string parameters for automated action blocks.

• ○

  To create text strings that merge state text with dynamic values for input or output.

Select an option, then click Submit answer.

• ○

  Incorrect Join configuration on the second playbook.

• ○

  The first playbook is performing poorly.

• ○

  The steep option for the second playbook is not set to a long enough interval.

• ○

  Synchronous execution has not been configured.

Select an option, then click Submit answer.

• ○

  Workbook page Evidence tab.

• ○

  Evidence report.

• ○

  Investigation page Evidence tab.

• ○

  At the bottom of the Investigation page widget panel.

Select an option, then click Submit answer.

• ○

  Map CIM to CEF fields.

• ○

  Create a Splunk alert that uses the event_forward.py script to send events to Phantom.

• ○

  Map CEF to CIM fields.

• ○

  Create a saved search that generates the JSON for the new container on Phantom.

Select an option, then click Submit answer.

• ○

  !(pipe)

• ○

  *(asterisk)

• ○

  :(colon)

• ○

  .(dot)

Select an option, then click Submit answer.

• ○

  List of the apps used by the playbook.

• ○

  List of the actions of the playbook design.

• ○

  List of the outputs of the playbook design.

• ○

  List of the data needed to run the playbook.

Select an option, then click Submit answer.

• ○

  No.

• ○

  No, but this can be changed by setting the proper permissions.

• ○

  Yes, in the global block.

• ○

  Yes. from a drop down menu.

Select an option, then click Submit answer.

• ○

  Use the contextual menu from the artifact and select run playbook.

• ○

  Use the run playbook dialog and set the scope to the artifact.

• ○

  Create a new container including Just the artifact in question.

• ○

  Use the contextual menu from the artifact and select the actions.

Select an option, then click Submit answer.

• ○

  Any of the integrated Splunk/Phantom Apps

• ○

  Splunk App for Phantom Reporting.

• ○

  Splunk App for Phantom.

• ○

  Phantom App for Splunk.

Select an option, then click Submit answer.

• ○

  SAML3

• ○

  PIV/CAC

• ○

  Biometrics

• ○

  OpenID