Which of the following is an advantage of using the Visual Playbook Editor?

Eliminates any need to use Python code.

The Visual Playbook Editor is the only way to generate user prompts.

A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes. What is the cause of this behavior?

Synchronous execution has not been configured.

The first playbook is performing poorly.

The sleep option for the second playbook is not set to a long enough interval.

Incorrect join configuration on the second playbook.

When assigning an input parameter to an action while building a playbook, a user notices the artifact value they are looking for does not appear in the auto-populated list.How is it possible to enter the unlisted artifact value?

Type the CEF datapath in manually.

Delete and recreate the artifact.

Edit the artifact to enable the List as Parameter option for the CEF value.

Edit the container to allow CEF parameters.

Which of the following actions will store a compressed, secure version of an email attachment with suspected malware for future analysis?

Use the Upload action of the Secure Store app to store the file in the database.

Copy/paste the attachment into a note.

Add a link to the file in a new artifact.

Use the Files tab on the Investigation page to upload the attachment.

Use the Upload action of the Secure Store app to store the file in the database.

Which of the following are the default ports that must be configured on Splunk to allow connections from SOAR?

SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)

SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000)

SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000)

SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)

SplunkWeb (8469), SplunkD (8702), HTTP Collector (8864)

How can more than one user perform tasks in a workbook?

Any user with a role that has Perform Task enabled can execute tasks for workbooks.

Any user in a role with write access to the case's workbook can be assigned to tasks.

Add the required users to the authorized list for the container.

Any user with a role that has Perform Task enabled can execute tasks for workbooks.

The container owner can assign any authorized user to any task in a workbook.

What users are included in a new installation of SOAR?

The admin and automation users are included by default.

The admin, power, and user users are included by default.

Only the admin user is included by default.

No users are included by default.

Under Asset Ingestion Settings, how many labels must be applied when configuring an asset?

Labels are not configured under Asset Ingestion Settings.

Which of the following can be done with the System Health Display?

View a single column of status for SOAR processes. For metrics, click Details.

Create a temporary, edited version of a process and test the results.

Partially rewind processes, which is useful for debugging.

View a single column of status for SOAR processes. For metrics, click Details.

Reset DECIDED to reset playbook environments back to at-start conditions.

When the Splunk App for SOAR Export executes a Splunk search, which activities are completed?

CIM fields are mapped to CEF fields and a container is created on the SOAR server.

CEF fields are mapped to CIM flelds and a container is created on the SOAR server.

CIM fields are mapped to CEF fields and a container is created on the SOAR server.

CEF fields are mapped to CIM and a container is created on the Splunk server.

CIM fields are mapped to CEF and a container is created on the Splunk server.

Splunk SPLK-2003 Practice Test 3 - Free Online Exam Prep & Questions

The SOAR server has been configured to use an external Splunk search head for search and searching on SOAR works; however, the search results don't include content that was being returned by search before configuring external search. Which of the following could be the problem?

Become a Premium Member for full access

Unlock Premium Member

Splunk SPLK-2003 Practice Test 3

Question

Splunk SPLK-2003 Practice Tests

Practice Tests