Guaranteed High Marks with Updated & Real SPLK-2003 Dumps pdf Free Updates
PASS RATE Splunk SOAR Certified Automation Developer SPLK-2003 Certified Exam DUMP
NEW QUESTION # 17
Which of the following are the default ports that must be configured on Splunk to allow connections from Phantom?
- A. SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)
- B. SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000)
- C. SplunkWeb (8421), SplunkD (8061), HTTP Collector (8798)
- D. SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000)
Answer: A
Explanation:
Explanation
The correct answer is D because the default ports that must be configured on Splunk to allow connections from Phantom are SplunkWeb (8000), SplunkD (8089), and HTTP Collector (8088). SplunkWeb is the port used to access the Splunk web interface. SplunkD is the port used to communicate with the Splunk server.
HTTP Collector is the port used to send data to Splunk using the HTTP Event Collector (HEC). These ports must be configured on Splunk and Phantom to enable the integration between the two products. See Splunk SOAR Documentation for more details.
NEW QUESTION # 18
Which of the following can be configured in the ROl Settings?
- A. Analyst hours per month.
- B. Annual analyst salary.
- C. Time lost.
- D. Number of full time employees (FTEs).
Answer: D
Explanation:
Explanation
The correct answer is C because the number of full time employees (FTEs) is one of the settings that can be configured in the Return on Investment (ROI) Settings page. This setting is used to calculate the ROI metrics based on the number of analysts in the organization. The answer A is incorrect because the analyst hours per month is not a configurable setting, but a calculated metric based on the FTEs and the average hours per month. The answer B is incorrect because the time lost is not a configurable setting, but a calculated metric based on the number of incidents and the average time lost per incident. The answer D is incorrect because the annual analyst salary is not a configurable setting, but a calculated metric based on the FTEs and the average salary per analyst. Reference: Splunk SOAR Admin Guide, page 131.
NEW QUESTION # 19
Seventy can be set during ingestion and later changed manually. What other mechanism can change the severity or a container?
- A. Notes
- B. Service level agreement (SLA) expiration
- C. Playbooks
- D. Actions
Answer: C
Explanation:
Explanation
Playbooks can change the severity of a container by using the set severity action block. This block allows the user to specify a new severity level for the container or use a variable from a previous action result. Notes and actions do not affect the severity of a container, and SLA expiration only affects the status of the container, not the severity. Reference, page 10.
NEW QUESTION # 20
What are the differences between cases and events?
- A. Cases: incidents with a known violation and a plan for correction.
Events: occurrences in the system that may require a response. - B. Case: potential threats.
Events: identified as a specific kind of problem and need a structured approach. - C. Cases: contain a collection of containers.
Events: contain potential threats. - D. Cases: only include high-level incident artifacts.
Events: only include low-level incident artifacts.
Answer: A
Explanation:
Explanation
Cases and events are two types of containers in Phantom. Cases are incidents with a known violation and a plan for correction, such as a malware infection, a phishing attack, or a data breach. Events are occurrences in the system that may require a response, such as an alert, a log entry, or an email. Cases and events can contain both high-level and low-level incident artifacts, such as IP addresses, URLs, files, or users. Cases do not contain a collection of containers, but rather a collection of artifacts, tasks, notes, and comments. Events are not necessarily potential threats, but rather indicators of potential threats. Reference, page 9.
NEW QUESTION # 21
A customer wants to design a modular and reusable set of playbooks that all communicate with each other.
Which of the following is a best practice for data sharing across playbooks?
- A. Cal the child playbooks getter function.
- B. Use the py-postgresq1 module to directly save the data in the Postgres database.
- C. Create artifacts using one playbook and collect those artifacts in another playbook.
- D. Use the Handle method to pass data directly between playbooks.
Answer: B
NEW QUESTION # 22
Which of the following will show all artifacts that have the term results in a filePath CEF value?
- A. ...rest/artifacts/filePath=''%results%''
- B. .../result/artifact?_query_cef_filepath_icontains=''results
- C. .../result/artifacts/cef/filePath= '%results%''
- D. .../rest/artifact?_filter_cef_filePath_icontain=''results''
Answer: B
NEW QUESTION # 23
After enabling multi-tenancy, which of the Mowing is the first configuration step?
- A. Select the associated tenant artifacts.
- B. Set default tenant base address.
- C. Change the tenant permissions.
- D. Configure the default tenant.
Answer: D
Explanation:
Explanation
The correct answer is D because the first configuration step after enabling multi-tenancy is to configure the default tenant. Multi-tenancy is a feature that allows you to create multiple logical partitions of Phantom data and assets for different groups of users. The default tenant is the tenant that is created when Phantom is installed and contains all the existing data and assets. You need to configure the default tenant's name, description, base address, and logo before creating other tenants. See Splunk SOAR Documentation for more details.
NEW QUESTION # 24
How can the debug log for a playbook execution be viewed?
- A. On the Investigation page, select Debug Log from the playbook's action menu in the Recent Activity panel.
- B. In Administration > System Health > Playbook Run History, select the playbook execution entry, then select Log.
- C. Open the playbook in the Visual Playbook Editor, and select Debug Logs in Settings.
- D. Click Expand Scope m the debug window.
Answer: D
NEW QUESTION # 25
During a second test of a playbook, a user receives an error that states: 'an empty parameters list was passed to phantom.act()." What does this indicate?
- A. The playbook debugger's scope is set to new.
- B. The playbook debugger's scope is set to all.
- C. The container has artifacts not parameters.
- D. The playbook is using an incorrect container.
Answer: A
Explanation:
Explanation
The correct answer is C because the error message indicates that the playbook debugger's scope is set to new.
The scope option determines which containers are used for debugging the playbook. If the scope is set to new, the debugger will only use containers that are created after the debugger is started. If the scope is set to all, the debugger will use all containers that match the playbook's filter criteria. The error message means that the debugger did not find any new containers with parameters to pass to the phantom.act() function. See Splunk SOAR Documentation for more details.
NEW QUESTION # 26
Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?
- A. phantomsearch, phantomdelete
- B. phantomcreate. phantomedit
- C. admin,user
- D. superuser, administrator
Answer: D
NEW QUESTION # 27
Seventy can be set during ingestion and later changed manually. What other mechanism can change the severity or a container?
- A. Actions
- B. Notes
- C. Service level agreement (SLA) expiration
- D. Playbooks
Answer: A
NEW QUESTION # 28
Which of the following expressions will output debug information to the debug window in the Visual Playbook Editor?
- A. phantom.exception()
- B. phantom.print ()
- C. phantom.debug()
- D. phantom.assert()
Answer: C
Explanation:
Explanation
The correct answer is A because the phantom.debug() function is used to output debug information to the debug window in the Visual Playbook Editor. This function can be useful for troubleshooting and testing playbooks. The answer B is incorrect because the phantom.exception() function is used to output exception information to the debug window in the Visual Playbook Editor. This function can be useful for handling errors and exceptions in playbooks. The answer C is incorrect because the phantom.print() function is used to output information to the standard output stream in the Phantom server. This function can be useful for logging and auditing purposes. The answer D is incorrect because the phantom.assert() function is used to check if a condition is true or false and raise an exception if it is false. This function can be useful for validating inputs and outputs in playbooks. Reference: Splunk SOAR Playbook Development Guide, page 22.
NEW QUESTION # 29
During a second test of a playbook, a user receives an error that states: 'an empty parameters list was passed to phantom.act()." What does this indicate?
- A. The playbook debugger's scope is set to all.
- B. The container has artifacts not parameters.
- C. The playbook debugger's scope is set to new.
- D. The playbook is using an incorrect container.
Answer: B
NEW QUESTION # 30
When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible
- A. Configure the second query in the Phantom app for Splunk.
- B. Configure a second Splunk asset with the second query.
- C. Enter the two queries in the asset as comma separated values.
- D. Install a second Splunk app and configure the query in the second app.
Answer: B
Explanation:
Explanation
The correct answer is D because to run two different on_poll searches, you need to configure a second Splunk asset with the second query. The on_poll search is the query that Phantom uses to fetch events from Splunk and create containers and artifacts. You can only specify one on_poll search per Splunk asset. If you want to run another on_poll search, you need to create another Splunk asset with a different name and IP address and configure the second query in the asset settings. See Splunk SOAR Documentation for more details.
NEW QUESTION # 31
Is it possible to import external Python libraries such as the time module?
- A. Yes. from a drop down menu.
- B. No.
- C. Yes, in the global block.
- D. No, but this can be changed by setting the proper permissions.
Answer: C
NEW QUESTION # 32
Which of the following is the complete list of the types of backups that are supported by Phantom?
- A. Full, delta, and incremental backups.
- B. Full backups.
- C. Full and incremental backups.
- D. Full and delta backups.
Answer: C
NEW QUESTION # 33
Which app allows a user to send Splunk Enterprise Security notable events to Phantom?
- A. Splunk App for Phantom Reporting.
- B. Splunk App for Phantom.
- C. Any of the integrated Splunk/Phantom Apps
- D. Phantom App for Splunk.
Answer: C
NEW QUESTION # 34
Some of the playbooks on the Phantom server should only be executed by members of the admin role. How can this rule be applied?
- A. Place restricted playbooks in a second source repository that has restricted access.
- B. Make sure the Execute Playbook capability is removed from al roles except admin.
- C. Add a filter block to al restricted playbooks that Titters for runRole - "Admin''.
- D. Add a tag with restricted access to the restricted playbooks.
Answer: C
NEW QUESTION # 35
......
Best SPLK-2003 Exam Preparation Material with New Dumps Questions: https://www.certkingdompdf.com/SPLK-2003-latest-certkingdom-dumps.html
Updates For the Latest SPLK-2003 Free Exam Study Guide!: https://drive.google.com/open?id=1eHoScqBU1ZePrYwuPf8-V72mSq_rlwsN