[Mar-2023] Pass Splunk SPLK-2003 Exam in First Attempt Guaranteed! [Q20-Q39]

admin SPLK-2003 Splunk March 3, 2023

4/5 - (1 vote)

[Mar-2023] Pass Splunk SPLK-2003 Exam in First Attempt Guaranteed!

Full SPLK-2003 Practice Test and 60 unique questions with explanations waiting just for you, get it now!

Q20. Which of the following can the format block be used for?

To generate arrays for input into other functions.

To generate HTML or CSS content for output in email messages, user prompts, or comments.

To generate string parameters for automated action blocks.

To create text strings that merge state text with dynamic values for input or output.

Q21. Which is the primary system requirement that should be increased with heavy usage of the file vault?

Amount of memory.

Number of processors.

Amount of storage.

Bandwidth of network.

Q22. Which app allows a user to run Splunk queries from within Phantom?

Splunk App for Phantom?

The Integrated Splunk/Phantom app.

Phantom App for Splunk.

Splunk App for Phantom Reporting.

Q23. After enabling multi-tenancy, which of the Mowing is the first configuration step?

Select the associated tenant artifacts.

Change the tenant permissions.

Set default tenant base address.

Configure the default tenant.

Q24. Which of the following is the complete list of the types of backups that are supported by Phantom?

Full backups.

Full, delta, and incremental backups.

Full and incremental backups.

Full and delta backups.

Q25. Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment’ Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.

On the command line enter: rode sudo python ibackup.pyc –setup, then audo phenv python ibackup.pyc
–backup.

On the command line enter: sudo phenv python ibackup.pyc –backup -backup-type full, then sudo phenv python ibackup.pyc –setup.

Within the UI: Select from the main menu Administration > System Health > Backup.

Within the UI: Select from the main menu Administration > Product Settings > Backup.

Q26. Which of the following are examples of things commonly done with the Phantom REST APP

Use Django queries; use curl to create a container and add artifacts to it; remove temporary lists.

Use Django queries; use Docker to create a container and add artifacts to it; remove temporary lists.

Use Django queries; use curl to create a container and add artifacts to it; add action blocks.

Use SQL queries; use curl to create a container and add artifacts to it; remove temporary lists.

Q27. Which of the following is a best practice for use of the global block?

Execute code at the beginning of each run of the playbook.

Declare outputs which will be selectable within playbook blocks.

Import packages which will be used within the playbook.

Execute custom code after each run of the playbook.

Q28. How can a child playbook access the parent playbook’s action results?

Child playbooks can access parent playbook data while the parent Is still running.

By setting scope to ALL when starting the child.

When configuring the playbook block in the parent, add the desired results in the Scope parameter.

The parent can create an artifact with the data needed by the did.

Q29. In addition to full backups. Phantom supports what other backup type using backup?

Snapshot

Incremental

Partial

Differential

Q30. How is it possible to evaluate user prompt results?

Set action_result.summary. status to required.

Set the user prompt to reinvoke if it times out.

Set action_result. summary. response to required.

Add a decision Mode

Q31. In this image, which container fields are searched for the text “Malware”?

Event Name and Artifact Names.

Event Name, Notes, Comments.

Event Name or ID.

Q32. What is enabled if the Logging option for a playbook’s settings is enabled?

More detailed logging information Is available m the Investigation page.

All modifications to the playbook will be written to the audit log.

More detailed information is available in the debug window.

The playbook will write detailed execution information into the spawn.log.

Q33. When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible

Enter the two queries in the asset as comma separated values.

Configure the second query in the Phantom app for Splunk.

Install a second Splunk app and configure the query in the second app.

Configure a second Splunk asset with the second query.

Q34. After a successful POST to a Phantom REST endpoint to create a new object what result is returned?

The new object ID.

The new object name.

The full CEF name.

The PostGres UUID.

Q35. Which Phantom VPE Nock S used to add information to custom lists?

Action blocks

Filter blocks

API blocks

Decision blocks

Q36. Which of the following will show all artifacts that have the term results in a filePath CEF value?

…/rest/artifact?_filter_cef_filePath_icontain=”results”

…rest/artifacts/filePath=”%results%”

…/result/artifacts/cef/filePath= ‘%results%”

…/result/artifact?_query_cef_filepath_icontains=”results

Q37. Within the 12A2 design methodology, which of the following most accurately describes the last step?

List of the apps used by the playbook.

List of the actions of the playbook design.

List of the outputs of the playbook design.

List of the data needed to run the playbook.

Q38. Some of the playbooks on the Phantom server should only be executed by members of the admin role. How can this rule be applied?

Add a filter block to al restricted playbooks that Titters for runRole – “Admin”.

Add a tag with restricted access to the restricted playbooks.

Make sure the Execute Playbook capability is removed from al roles except admin.

Place restricted playbooks in a second source repository that has restricted access.

Q39. A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?

Null IP addresses

Non-null IP addresses

Non-null destinationAddresses

Null values

Loading …