Which of the following is an advantage of using the Visual Playbook Editor?

Eliminates any need to use Python code.

The Visual Playbook Editor is the only way to generate user prompts.

A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes. What is the cause of this behavior?

Synchronous execution has not been configured.

The first playbook is performing poorly.

The sleep option for the second playbook is not set to a long enough interval.

Incorrect join configuration on the second playbook.

When assigning an input parameter to an action while building a playbook, a user notices the artifact value they are looking for does not appear in the auto-populated list.How is it possible to enter the unlisted artifact value?

Type the CEF datapath in manually.

Delete and recreate the artifact.

Edit the artifact to enable the List as Parameter option for the CEF value.

Edit the container to allow CEF parameters.

Which of the following actions will store a compressed, secure version of an email attachment with suspected malware for future analysis?

Use the Upload action of the Secure Store app to store the file in the database.

Copy/paste the attachment into a note.

Add a link to the file in a new artifact.

Use the Files tab on the Investigation page to upload the attachment.

Use the Upload action of the Secure Store app to store the file in the database.

Which of the following are the default ports that must be configured on Splunk to allow connections from SOAR?

SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)

SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000)

SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000)

SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)

SplunkWeb (8469), SplunkD (8702), HTTP Collector (8864)

How can more than one user perform tasks in a workbook?

Any user with a role that has Perform Task enabled can execute tasks for workbooks.

Any user in a role with write access to the case's workbook can be assigned to tasks.

Add the required users to the authorized list for the container.

Any user with a role that has Perform Task enabled can execute tasks for workbooks.

The container owner can assign any authorized user to any task in a workbook.

What users are included in a new installation of SOAR?

The admin and automation users are included by default.

The admin, power, and user users are included by default.

Only the admin user is included by default.

No users are included by default.

Under Asset Ingestion Settings, how many labels must be applied when configuring an asset?

Labels are not configured under Asset Ingestion Settings.

Which of the following can be done with the System Health Display?

View a single column of status for SOAR processes. For metrics, click Details.

Create a temporary, edited version of a process and test the results.

Partially rewind processes, which is useful for debugging.

View a single column of status for SOAR processes. For metrics, click Details.

Reset DECIDED to reset playbook environments back to at-start conditions.

When the Splunk App for SOAR Export executes a Splunk search, which activities are completed?

CIM fields are mapped to CEF fields and a container is created on the SOAR server.

CEF fields are mapped to CIM flelds and a container is created on the SOAR server.

CIM fields are mapped to CEF fields and a container is created on the SOAR server.

CEF fields are mapped to CIM and a container is created on the Splunk server.

CIM fields are mapped to CEF and a container is created on the Splunk server.

On the Splunk search head, when configuring the app to search SOAR searchable content, what are the two requirements to complete the app setup?

User accounts and an HTTP Event Collector token.

User accounts and universal forwarder.

User accounts and an HTTP Event Collector token.

Which of the following is the best option for an analyst who wants to run a single action on an event?

Open the event and run this single action from the Investigation View.

Create a playbook with a single action then use the Playbook Debugger on the event ID.

Create a playbook with the action and run it from the Investigation View.

Open a playbook with a single action, mark it active, and then use the Playbook Debugger on the event ID.

Which of the following are tabs of an asset configuration?

Asset Info, Asset Settings, Approval Settings, Access Control

Asset Name, Asset IP, Asset URL, Asset Nickname

Tags, Asset Name, Asset Date, Asset Order

App Name, App Order, App Expiry, App Version

Asset Info, Asset Settings, Approval Settings, Access Control

Playbooks typically handle which types of data?

Container data, Artifact CEF data, Result data, List data

Container data, Artifact CEF data, Result data. Threat data

Container CEF data, Artifact data, Result data, List data

Container data, Artifact CEF data, Result data, List data

Container data, Artifact data, Result data, Threat data

Which of the following is true about a child playbook?

The child playbook has access to the parent playbook's container and the parent's action result data.

The child playbook does not have access to the parent playbook's container or action result data.

The child playbook does not have access to the parent playbook's container, but to the parent's action result data.

The child playbook has access to the parent playbook's container and the parent's action result data.

The child playbook has access to the parent playbook's container, but not to the parent's action result data.

Regarding the Splunk SOAR Automation Broker requirements, which of the following statements is not correct?

The Splunk SOAR Automation Broker requires inbound/ingress network connection from the Splunk SOAR (Cloud) or Splunk SOAR (On-premises) instance.

The Splunk SOAR Automation Broker requires outbound/egress connectivity to the Splunk SOAR (Cloud) or Splunk SOAR (On-premises) instance.

The Splunk SOAR Automation Broker must be able to connect to TCP port 443 (HTTPS) on the Splunk SOAR (Cloud) or Splunk SOAR (On-premises) instance.

The Splunk SOAR Automation Broker requires both inbound/ingress and outbound/egress connectivity to the Splunk SOAR (Cloud) or Splunk SOAR (On-premises) instance.

The Splunk SOAR Automation Broker requires inbound/ingress network connection from the Splunk SOAR (Cloud) or Splunk SOAR (On-premises) instance.

How can a user with the username 'pat' configure the Analyst Queue to only show new events that are assigned to the current user?

Create a filter for status=new and owner=pat.

Create a filter for label-new and owner-pat.

Create a filter for status-open and owner-pat.

Create a filter for status=new and owner=pat.

Create a filter for status=new or owner=pat.

How can parent and child playbooks pass information to each other?

The parent can pass arguments to the child when called, and the child can return values from the end block.

The parent can pass arguments to the child when called, but the child can only pass values back as new artifacts in the event.

The parent must create a new artifact in the event named arg_xxx, and the child must return values by creating artifacts with the naming convention return_xxx.

The parent must create a new artifact in the event named return_xxx, and the child must return values by creating artifacts with the naming convention arg_xxx.

Splunk SPLK-2003 Practice Test 3 - Free Online Exam Questions 81-110

The SOAR server has been configured to use an external Splunk search head for search and searching on SOAR works; however, the search results don't include content that was being returned by search before configuring external search. Which of the following could be the problem?

Become a Premium Member for full access

Unlock Premium Member

Splunk SPLK-2003 Practice Test 3

Question

Drag and Drop

Hot Area

Splunk SPLK-2003 Practice Tests

Practice Tests