SPLK-2003 Exam Questions

Which of the following accurately describes the Files tab on the Investigate page?

Without customizing container status within Phantom, what are the three types of status for a container?

Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?

Phantom supports multiple user authentication methods such as LDAP and SAML2. What other user authentication method is supported?

During a second test of a playbook, a user receives an error that states: "an empty parameters list was passed to phantom.act()." What does this indicate?

What does a user need to do to have a container with an event from Splunk use context-aware actions designed for notable events?

After enabling multi-tenancy, which of the Mowing is the first configuration step?

When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this p...

Which of the following can be edited or deleted in the Investigation page?

Which visual playbook editor block is used to assemble commands and data into a valid Splunk search within a SOAR playbook?

Which of the following contains official SOAR documentation for the latest releases?

Two action blocks, geolocate_ip_1 and file_reputation_2, are connected to a decision block. Which of the following is a correct configuration for making a decision on the action re...

Which of the following items cannot be modified once entered into SOAR?

Which of the following can be done with the System Health Display?

Which of the following is accurate?

Playbooks typically handle which types of data?

Which of the following are tabs of an asset configuration?

Splunk user account(s) with which roles must be created to configure SOAR with an external Splunk Enterprise instance?

Which of the following is a way to access lists?

How can the DECIDED process be restarted?

Which of the following queries would return all failed playbook runs from the REST API?

How can a playbook run searches on a Splunk search head?

In a playbook, more than one Action block can be active at one time. What is this called?

Which Splunk search command is used to send a notable event to SOAR?

Which of the following is a reason to create a new role in SOAR?

Which of the following roles is appropriate for a Splunk SOAR account that will only be used to execute automated tasks?

If two or more conditions apply to data in a filter block, which path is followed in the playbook?

If the SOAR New status is removed and replaced by In Progress, what status is shown for containers that had the new status before the replacement?

On the Splunk search head, when configuring the app to search SOAR searchable content, what are the two requirements to complete the app setup?

What metrics can be seen from the System Health Display? (Choose all that apply.)

What primary integrations does Splunk SOAR provide for Role administration? (Choose all that apply.)

Which of the following cannot be marked as evidence in a container?

What is the primary objective of using the I2A2 playbook design methodology?

Which set of steps will show the most detailed information for action results on the Investigation page?

What users are included in a new installation of SOAR?

In the SOAR main menu, there are sub-options below Sources. What is the purpose of these options?

If no data matches any filter conditions, what is the next block run by the playbook?

How can more than one user perform tasks in a workbook?

Which of the following queries would return all artifacts that contain a SHA1 file hash?

What is the default embedded search engine used by SOAR?

How can the DECIDED process be restarted?

Which of the following can be configured in the ROI Settings?

What are the components of the I2A2 design methodology?

Some of the playbooks on the SOAR server should only be executed by members of the admin role. How can this rule be applied?

Which of the following can be edited or deleted in the Investigation page?

Why is it good playbook design to create smaller and more focused playbooks? (select all that apply)

What is the default log level for system health debug logs?

Why does SOAR use wildcards within artifact data paths?

Which of the following roles is appropriate for a Splunk SOAR account that will only be used to execute automated tasks?

To limit the impact of custom code on the VPE, where should the custom code be placed?