SPLK-2003 Exam Questions

Which of the following are examples of things commonly done with the Phantom REST APP

Which of the following are the default ports that must be configured on Splunk to allow connections from SOAR?

On a multi-tenant Phantom server, what is the default tenant's ID?

What are indicators?

Which app allows a user to send Splunk Enterprise Security notable events to Phantom?

Some of the playbooks on the Phantom server should only be executed by members of the admin role. How can this rule be applied?

What values can be applied when creating Custom CEF field?

What is enabled if the Logging option for a playbook's settings is enabled?

Is it possible to import external Python libraries such as the time module?

How can an individual asset action be manually started?

What is the default embedded search engine used by Phantom?

A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?

A user wants to get the playbook results for a single artifact. Which steps will accomplish the?

What is the main purpose of using a customized workbook?

Which of the following is a step when configuring event forwarding from Splunk to Phantom?

Which is the primary system requirement that should be increased with heavy usage of the file vault?

Which of the following will show all artifacts that have the term results in a filePath CEF value?

Which of the following can be configured in the ROl Settings?

Which of the following expressions will output debug information to the debug window in the Visual Playbook Editor?

Which of the following supported approaches enables Phantom to run on a Windows server?

Which of the following can the format block be used for?

When analyzing events a working on a case, significant items can be marked as evidence. Where can ail of a case's evidence items be viewed together?

When working with complex datapaths, which operator is used to access a sub-element inside another element?

Which of the following is a best practice for use of the global block?

In this image, which container fields are searched for the text "Malware"?

Which of the following is the complete list of the types of backups that are supported by Phantom?

How can the debug log for a playbook execution be viewed?

Which of the following describes the use of labels m Phantom?

What is the simplest way to pass data between playbooks?

What do assets provide for app functionality?

After a successful POST to a Phantom REST endpoint to create a new object what result is returned?

After a playbook has run, where are the results stored?

Seventy can be set during ingestion and later changed manually. What other mechanism can change the severity or a container?

In addition to full backups. Phantom supports what other backup type using backup?

How can a child playbook access the parent playbook's action results?

How does a user determine which app actions are available?

What are the differences between cases and events?

Which Phantom API command is used to create a custom list?

Configuring Phantom search to use an external Splunk server provides which of the following benefits?

Within the 12A2 design methodology, which of the following most accurately describes the last step?

Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment' Assume the commands are executed from /opt/phantom/bin and that no other bac...

An active playbook can be configured to operate on all containers that share which attribute?

Which of the following applies to filter blocks?

A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes. What...

A customer wants to design a modular and reusable set of playbooks that all communicate with each other. Which of the following is a best practice for data sharing across playbooks...

A user wants to use their Splunk Cloud instance as the external Splunk instance for Phantom. What ports need to be opened on the Splunk Cloud instance to facilitate this? Assume de...

Which app allows a user to run Splunk queries from within Phantom?

Which Phantom VPE Nock S used to add information to custom lists?

How is it possible to evaluate user prompt results?

When is using decision blocks most useful?