SPLK-2003 Exam Questions
124 real SPLK-2003 exam questions with expert-verified answers and explanations. Page 2 of 3.
- Question #51
Which of the following accurately describes the Files tab on the Investigate page?
- Question #52
Without customizing container status within Phantom, what are the three types of status for a container?
- Question #53
Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?
- Question #54
Phantom supports multiple user authentication methods such as LDAP and SAML2. What other user authentication method is supported?
- Question #55
During a second test of a playbook, a user receives an error that states: "an empty parameters list was passed to phantom.act()." What does this indicate?
- Question #56
What does a user need to do to have a container with an event from Splunk use context-aware actions designed for notable events?
- Question #57
After enabling multi-tenancy, which of the Mowing is the first configuration step?
- Question #58
When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this p...
- Question #59
Which of the following can be edited or deleted in the Investigation page?
- Question #60
Which visual playbook editor block is used to assemble commands and data into a valid Splunk search within a SOAR playbook?
- Question #61
Which of the following contains official SOAR documentation for the latest releases?
- Question #62
Two action blocks, geolocate_ip_1 and file_reputation_2, are connected to a decision block. Which of the following is a correct configuration for making a decision on the action re...
- Question #63
Which of the following items cannot be modified once entered into SOAR?
- Question #64
Which of the following can be done with the System Health Display?
- Question #65
Which of the following is accurate?
- Question #66
Playbooks typically handle which types of data?
- Question #67
Which of the following are tabs of an asset configuration?
- Question #68
Splunk user account(s) with which roles must be created to configure SOAR with an external Splunk Enterprise instance?
- Question #69
Which of the following is a way to access lists?
- Question #70
How can the DECIDED process be restarted?
- Question #71
Which of the following queries would return all failed playbook runs from the REST API?
- Question #72
How can a playbook run searches on a Splunk search head?
- Question #73
In a playbook, more than one Action block can be active at one time. What is this called?
- Question #74
Which Splunk search command is used to send a notable event to SOAR?
- Question #75
Which of the following is a reason to create a new role in SOAR?
- Question #76
Which of the following roles is appropriate for a Splunk SOAR account that will only be used to execute automated tasks?
- Question #77
If two or more conditions apply to data in a filter block, which path is followed in the playbook?
- Question #78
If the SOAR New status is removed and replaced by In Progress, what status is shown for containers that had the new status before the replacement?
- Question #79
On the Splunk search head, when configuring the app to search SOAR searchable content, what are the two requirements to complete the app setup?
- Question #80
What metrics can be seen from the System Health Display? (Choose all that apply.)
- Question #81
What primary integrations does Splunk SOAR provide for Role administration? (Choose all that apply.)
- Question #82
Which of the following cannot be marked as evidence in a container?
- Question #83
What is the primary objective of using the I2A2 playbook design methodology?
- Question #84
Which set of steps will show the most detailed information for action results on the Investigation page?
- Question #85
What users are included in a new installation of SOAR?
- Question #86
In the SOAR main menu, there are sub-options below Sources. What is the purpose of these options?
- Question #87
If no data matches any filter conditions, what is the next block run by the playbook?
- Question #88
How can more than one user perform tasks in a workbook?
- Question #89
Which of the following queries would return all artifacts that contain a SHA1 file hash?
- Question #90
What is the default embedded search engine used by SOAR?
- Question #91
How can the DECIDED process be restarted?
- Question #92
Which of the following can be configured in the ROI Settings?
- Question #93
What are the components of the I2A2 design methodology?
- Question #94
Some of the playbooks on the SOAR server should only be executed by members of the admin role. How can this rule be applied?
- Question #95
Which of the following can be edited or deleted in the Investigation page?
- Question #96
Why is it good playbook design to create smaller and more focused playbooks? (select all that apply)
- Question #97
What is the default log level for system health debug logs?
- Question #98
Why does SOAR use wildcards within artifact data paths?
- Question #99
Which of the following roles is appropriate for a Splunk SOAR account that will only be used to execute automated tasks?
- Question #100
To limit the impact of custom code on the VPE, where should the custom code be placed?