[Sep-2022] SPLK-2003 Dumps are Available for Instant Access from TestInsides
Study resources for the Valid SPLK-2003 Braindumps!
NEW QUESTION 15
Which of the following will show all artifacts that have the term results in a filePath CEF value?
- A. .../rest/artifact?_filter_cef_filePath_icontain=''results''
- B. .../result/artifacts/cef/filePath= '%results%''
- C. ...rest/artifacts/filePath=''%results%''
- D. .../result/artifact?_query_cef_filepath_icontains=''results
Answer: D
NEW QUESTION 16
After a successful POST to a Phantom REST endpoint to create a new object what result is returned?
- A. The new object ID.
- B. The new object name.
- C. The full CEF name.
- D. The PostGres UUID.
Answer: D
NEW QUESTION 17
Which of the following is a step when configuring event forwarding from Splunk to Phantom?
- A. Create a Splunk alert that uses the event_forward.py script to send events to Phantom.
- B. Create a saved search that generates the JSON for the new container on Phantom.
- C. Map CEF to CIM fields.
- D. Map CIM to CEF fields.
Answer: C
NEW QUESTION 18
What is the default embedded search engine used by Phantom?
- A. Embedded Elastic search engine.
- B. Embedded Django search engine.
- C. Embedded Phantom search engine.
- D. Embedded Splunk search engine.
Answer: A
NEW QUESTION 19
Which is the primary system requirement that should be increased with heavy usage of the file vault?
- A. Amount of memory.
- B. Number of processors.
- C. Amount of storage.
- D. Bandwidth of network.
Answer: C
NEW QUESTION 20
Is it possible to import external Python libraries such as the time module?
- A. Yes, in the global block.
- B. No.
- C. Yes. from a drop down menu.
- D. No, but this can be changed by setting the proper permissions.
Answer: A
NEW QUESTION 21
A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?
- A. Null values
- B. Null IP addresses
- C. Non-null destinationAddresses
- D. Non-null IP addresses
Answer: A
NEW QUESTION 22
Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?
- A. superuser, administrator
- B. phantomsearch, phantomdelete
- C. phantomcreate. phantomedit
- D. admin,user
Answer: A
NEW QUESTION 23
Which of the following is the complete list of the types of backups that are supported by Phantom?
- A. Full backups.
- B. Full, delta, and incremental backups.
- C. Full and delta backups.
- D. Full and incremental backups.
Answer: D
NEW QUESTION 24
Phantom supports multiple user authentication methods such as LDAP and SAML2. What other user authentication method is supported?
- A. SAML3
- B. PIV/CAC
- C. Biometrics
- D. OpenID
Answer: A
NEW QUESTION 25
Which of the following are the default ports that must be configured on Splunk to allow connections from Phantom?
- A. SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000)
- B. SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000)
- C. SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)
- D. SplunkWeb (8421), SplunkD (8061), HTTP Collector (8798)
Answer: C
NEW QUESTION 26
Seventy can be set during ingestion and later changed manually. What other mechanism can change the severity or a container?
- A. Actions
- B. Notes
- C. Service level agreement (SLA) expiration
- D. Playbooks
Answer: A
NEW QUESTION 27
Which of the following is a best practice for use of the global block?
- A. Execute code at the beginning of each run of the playbook.
- B. Declare outputs which will be selectable within playbook blocks.
- C. Import packages which will be used within the playbook.
- D. Execute custom code after each run of the playbook.
Answer: A
NEW QUESTION 28
What is enabled if the Logging option for a playbook's settings is enabled?
- A. More detailed logging information Is available m the Investigation page.
- B. All modifications to the playbook will be written to the audit log.
- C. The playbook will write detailed execution information into the spawn.log.
- D. More detailed information is available in the debug window.
Answer: C
NEW QUESTION 29
When working with complex datapaths, which operator is used to access a sub-element inside another element?
- A. !(pipe)
- B. .(dot)
- C. :(colon)
- D. *(asterisk)
Answer: A
NEW QUESTION 30
During a second test of a playbook, a user receives an error that states: 'an empty parameters list was passed to phantom.act()." What does this indicate?
- A. The container has artifacts not parameters.
- B. The playbook debugger's scope is set to new.
- C. The playbook debugger's scope is set to all.
- D. The playbook is using an incorrect container.
Answer: A
NEW QUESTION 31
What is the main purpose of using a customized workbook?
- A. Workbooks automatically implement a customized processing of events using Python code.
- B. Workbooks may not be customized; only default workbooks are permitted within Phantom.
- C. Workbooks guide user activity and coordination during event analysis and case operations.
- D. Workbooks apply service level agreements (SLAs) to containers and monitor completion status on the ROI dashboard.
Answer: B
NEW QUESTION 32
Which of the following are examples of things commonly done with the Phantom REST APP
- A. Use Django queries; use curl to create a container and add artifacts to it; remove temporary lists.
- B. Use SQL queries; use curl to create a container and add artifacts to it; remove temporary lists.
- C. Use Django queries; use curl to create a container and add artifacts to it; add action blocks.
- D. Use Django queries; use Docker to create a container and add artifacts to it; remove temporary lists.
Answer: C
NEW QUESTION 33
Which of the following expressions will output debug information to the debug window in the Visual Playbook Editor?
- A. phantom.debug()
- B. phantom.assert()
- C. phantom.print ()
- D. phantom.exception()
Answer: B
NEW QUESTION 34
Which app allows a user to run Splunk queries from within Phantom?
- A. Phantom App for Splunk.
- B. Splunk App for Phantom?
- C. Splunk App for Phantom Reporting.
- D. The Integrated Splunk/Phantom app.
Answer: B
NEW QUESTION 35
What are indicators?
- A. Artifact values with special security significance.
- B. Action results that may appear in multiple containers.
- C. Action result items that determine the flow of execution in a playbook.
- D. Artifact values that can appear in multiple containers.
Answer: D
NEW QUESTION 36
Which of the following can be configured in the ROl Settings?
- A. Analyst hours per month.
- B. Time lost.
- C. Annual analyst salary.
- D. Number of full time employees (FTEs).
Answer: C
NEW QUESTION 37
A customer wants to design a modular and reusable set of playbooks that all communicate with each other.
Which of the following is a best practice for data sharing across playbooks?
- A. Use the py-postgresq1 module to directly save the data in the Postgres database.
- B. Cal the child playbooks getter function.
- C. Create artifacts using one playbook and collect those artifacts in another playbook.
- D. Use the Handle method to pass data directly between playbooks.
Answer: A
NEW QUESTION 38
......
Updated SPLK-2003 Tests Engine pdf - All Free Dumps Guaranteed: https://actualtests.testinsides.top/SPLK-2003-dumps-review.html