Which of the following describes the use of labels m Phantom?

Labels determine which playbook(s) are executed when a container is created.

Labels determine the service level agreement (SLA) for a container.

Labels control the default seventy, ownership, and sensitivity for the container.

Labels control which apps are allowed to execute actions on the container.

Labels determine which playbook(s) are executed when a container is created.

What do assets provide for app functionality?

Assets provide location, credentials, and other parameters needed to run actions.

Assets provide hostnames, passwords, and other artifacts needed to run actions.

Assets provide Python code, REST API, and other capabilities needed to run actions.

Assets provide firewall, network, and data sources needed to run actions.

Seventy can be set during ingestion and later changed manually. What other mechanism can change the severity or a container?

Service level agreement (SLA) expiration

How can a child playbook access the parent playbook's action results?

When configuring the playbook block in the parent, add the desired results in the Scope parameter.

Child playbooks can access parent playbook data while the parent Is still running.

By setting scope to ALL when starting the child.

When configuring the playbook block in the parent, add the desired results in the Scope parameter.

The parent can create an artifact with the data needed by the did.

How does a user determine which app actions are available?

From the Apps menu, click the supported actions dropdown for each app.

Add an action block to a playbook canvas area.

Search the Apps category in the global search field.

From the Apps menu, click the supported actions dropdown for each app.

In the visual playbook editor, click Active and click the Available App Actions dropdown.

Which app allows a user to run Splunk queries from within Phantom?

The Integrated Splunk/Phantom app.

Splunk App for Phantom Reporting.

How is it possible to evaluate user prompt results?

Set action_result. summary. response to required.

Set action_result.summary. status to required.

Set the user prompt to reinvoke if it times out.

Set action_result. summary. response to required.

When is using decision blocks most useful?

When selecting one (or zero) possible paths in the playbook.

When processing different data in parallel.

When evaluating complex, multi-value results or artifacts.

When modifying downstream data hi one or more paths in the playbook.

Which of the following accurately describes the Files tab on the Investigate page?

A user can upload the output from a detonate action to the the files tab for further investigation.

Files tab items and artifacts are the only data sources that can populate active cases.

Files tab items cannot be added to investigations. Instead, add them to action blocks.

Phantom memory requirements remain static, regardless of Files tab usage.

What are the differences between cases and events?

Cases: contain a collection of containers.Events: contain potential threats.

Case: potential threats.Events: identified as a specific kind of problem and need a structured approach.

Cases: only include high-level incident artifacts.Events: only include low-level incident artifacts.

Cases: contain a collection of containers.Events: contain potential threats.

Cases: incidents with a known violation and a plan for correction.Events: occurrences in the system that may require a response.

Why is it good playbook design to create smaller and more focused playbooks? (select all that apply)

Reduce large complex playbooks which become difficult to maintain.

Encourages code reuse in a more compartmentalized form.

To avoid duplication of code across multiple playbooks.

Reduces amount of playbook data stored in each repo.

Reduce large complex playbooks which become difficult to maintain.

Encourages code reuse in a more compartmentalized form.

To avoid duplication of code across multiple playbooks.

Why does SOAR use wildcards within artifact data paths?

To make data access in playbooks easier.

To make playbooks more specific.

To make playbooks filter out nulls.

To make data access in playbooks easier.

To make decision execution in playbooks run faster.

Which of the following queries would return all artifacts that contain a SHA1 file hash?

https://<PHANTOM_URL>/rest/artifact?_filter_cef_Shal_contains=''''

https://<PHANTOM_URL>/rest/artifact?_filter_cef_md5_insull=false

https://<PHANTOM_URL>/rest/artifact?_filter_cef_Shal_contains=''''

https://<PHANTOM_URL>/rest/artifact?_filter_cef_shal_insull=False

https://<PHANTOM_URL>/rest/artifact?_filter_shal__insull=False

What is the default embedded search engine used by SOAR?

Embedded Elastic search engine.

How can the DECIDED process be restarted?

By restarting the automation service.

By restarting the playbook daemon.

In Administration > Server Settings.

By restarting the automation service.

Which of the following can be configured in the ROI Settings?

Number of full time employees (FTEs).

What are the components of the I2A2 design methodology?

Inputs, Interactions, Actions, Artifacts

Inputs, Interactions, Actions, Apps

Inputs, Interactions, Actions, Artifacts

Inputs, Interactions, Apps, Artifacts

Inputs, Interactions, Actions, Assets

Some of the playbooks on the SOAR server should only be executed by members of the admin role. How can this rule be applied?

Make sure the Execute Playbook capability is removed from all roles except admin.

Place restricted playbooks in a second source repository that has restricted access.

Add a filter block to all restricted playbooks that filters for runRole = 'Admin'.

Add a tag with restricted access to the restricted playbooks.

To limit the impact of custom code on the VPE, where should the custom code be placed?

A custom container or a separate KV store.

How is a Django filter query performed?

By adding parameters to the URL similar to the following: phantom/rest/container?_filter_tags_contains='sumo'.

phantom/rest/search/app/contains/'sumo'

Browse to the Django Filter Query Editor in the Administration panel.

Install the SOAR Django App first, then configure the search query in the App editor.

When configuring a Splunk asset for SOAR to connect to a Splunk Cloud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible?

Configure a second Splunk asset with the second query.

Install a second Splunk app and configure the query in the second app.

Configure the second query in the Splunk App for SOAR Export.

Enter the two queries in the asset as comma separated values.

Configure a second Splunk asset with the second query.

What is the primary objective of using the I2A2 playbook design methodology?

To create simple, reusable, modular playbooks.

To create playbooks that customers will not edit.

To meet customer requirements using a single playbook.

To create simple, reusable, modular playbooks.

Which of the following is a reason to create a new role in SOAR?

To define a set of users who have access to a restricted app.

To define a set of users who have access to a special label.

To define a set of users who have access to a restricted app.

To define a set of users who have access to an event's reports.

To define a set of users who have access to a sensitive tag.

Configuring SOAR search to use an external Splunk server provides which of the following benefits?

The ability to automate Splunk searches within SOAR.

The ability to run more complex reports on SOAR activities.

The ability to ingest Splunk notable events into SOAR.

The ability to automate Splunk searches within SOAR.

The ability to display results as Splunk dashboards within SOAR.

Splunk SPLK-2003 Practice Test 2 - Free Online Exam Prep & Questions

Question 1 / 40

How can the debug log for a playbook execution be viewed?

On the Investigation page, select Debug Log from the playbook's action menu in the Recent Activity panel.

Click Expand Scope m the debug window.

In Administration > System Health > Playbook Run History, select the playbook execution entry, then select Log.

Open the playbook in the Visual Playbook Editor, and select Debug Logs in Settings.

Comment (0)

Splunk SPLK-2003 Practice Test 2

Question

Splunk SPLK-2003 Practice Tests

Practice Tests