SPLK-2003 Dumps Help You Study Objectives

By practicing with SPLK-2003 exam-like questions, you can identify areas where you may need to focus your studies. Splunk SPLK-2003 dumps can help you create a more targeted study plan and avoid wasting time studying topics you already know well. Taking SPLK-2003 dumps can help you get used to the format and structure of the real exam. SPLK-2003 dumps can help you feel more comfortable and confident on exam day, which can improve your chances of success. Practice Splunk SPLK-2003 exam free dumps below.

Page 1 of 4

1. Which of the following is a step when configuring event forwarding from Splunk to Phantom?

Map CIM to CEF fields.

Create a Splunk alert that uses the event_forward.py script to send events to Phantom.

Map CEF to CIM fields.

Create a saved search that generates the JSON for the new container on Phantom.

 Loading...

2. In a playbook, more than one Action block can be active at one time.

What is this called?

Serial Processing

Parallel Processing

Multithreaded Processing

Juggle Processing

 Loading...

3. Which of the following actions will store a compressed, secure version of an email attachment with suspected malware for future analysis?

Copy/paste the attachment into a note.

Add a link to the file in a new artifact.

Use the Files tab on the Investigation page to upload the attachment.

Use the Upload action of the Secure Store app to store the file in the database.

 Loading...

4. What are the components of the I2A2 design methodology?

Inputs, Interactions, Actions, Apps

Inputs, Interactions, Actions, Artifacts

Inputs, Interactions, Apps, Artifacts

Inputs, Interactions, Actions, Assets

 Loading...

5. Which of the following will show all artifacts that have the term results in a filePath CEF value?

.../rest/artifact?_filter_cef_filePath_icontain=''results''

...rest/artifacts/filePath=''%results%''

.../result/artifacts/cef/filePath= '%results%''

.../result/artifact?_query_cef_filepath_icontains=''results

 Loading...

6. In addition to full backups. Phantom supports what other backup type using backup?

Snapshot

Incremental

Partial

Differential

 Loading...

7. Some of the playbooks on the Phantom server should only be executed by members of the admin role.

How can this rule be applied?

Add a filter block to al restricted playbooks that Titters for runRole - "Admin''.

Add a tag with restricted access to the restricted playbooks.

Make sure the Execute Playbook capability is removed from al roles except admin.

Place restricted playbooks in a second source repository that has restricted access.

 Loading...

8. Is it possible to import external Python libraries such as the time module?

No.

No, but this can be changed by setting the proper permissions.

Yes, in the global block.

Yes. from a drop-down menu.

 Loading...

9. How can the debug log for a playbook execution be viewed?

On the Investigation page, select Debug Log from the playbook's action menu in the Recent Activity panel.

Click Expand Scope m the debug window.

In Administration > System Health > Playbook Run History, select the playbook execution entry, then select Log.

Open the playbook in the Visual Playbook Editor, and select Debug Logs in Settings.

 Loading...

10. After enabling multi-tenancy, which of the Mowing is the first configuration step?

Select the associated tenant artifacts.

Change the tenant permissions.

Set default tenant base address.

Configure the default tenant.

 Loading...

Page 2 of 4

11. Which of the following is a reason to create a new role in SOAR?

To define a set of users who have access to a special label.

To define a set of users who have access to a restricted app.

To define a set of users who have access to an event's reports.

To define a set of users who have access to a sensitive tag.

 Loading...

12. Playbooks typically handle which types of data?

Container data, Artifact CEF data, Result data. Threat data

Container CEF data, Artifact data, Result data, List data

Container data, Artifact CEF data, Result data, List data

Container data, Artifact data, Result data, Threat data

 Loading...

13. How can the DECIDED process be restarted?

By restarting the playbook daemon.

On the System Health page.

In Administration > Server Settings.

By restarting the automation service.

 Loading...

14. How does a user determine which app actions are available?

Add an action block to a playbook canvas area.

Search the Apps category in the global search field.

From the Apps menu, click the supported actions dropdown for each app.

In the visual playbook editor, click Active and click the Available App Actions dropdown.

 Loading...

15. Which of the following is a best practice for use of the global block?

Execute code at the beginning of each run of the playbook.

Declare outputs which will be selectable within playbook blocks.

Import packages which will be used within the playbook.

Execute custom code after each run of the playbook.

 Loading...

16. Which Phantom VPE Nock S used to add information to custom lists?

Action blocks

Filter blocks

API blocks

Decision blocks

 Loading...

17. Which of the following can be configured in the ROl Settings?

Analyst hours per month.

Time lost.

Number of full time employees (FTEs).

Annual analyst salary.

 Loading...

18. Which of the following cannot be marked as evidence in a container?

Action result

Artifact

Note

Comment

 Loading...

19. Where can the Splunk App for SOAR Export be downloaded from?

GitHub and Splunkbase.

SOAR Community and GitHub.

Splunkbase and SOAR Community.

Splunk Answers and Splunkbase.

 Loading...

20. Splunk user account(s) with which roles must be created to configure Phantom with an external

Splunk Enterprise instance?

superuser, administrator

phantomcreate. phantomedit

phantomsearch, phantomdelete

admin,user

 Loading...

Page 3 of 4

21. What users are included in a new installation of SOAR?

The admin and automation users are included by default.

The admin, power, and user users are included by default.

Only the admin user is included by default.

No users are included by default.

 Loading...

22. A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes.

What is the cause of this behavior?

Incorrect Join configuration on the second playbook.

The first playbook is performing poorly.

The steep option for the second playbook is not set to a long enough interval.

Synchronous execution has not been configured.

 Loading...

23. Within the 12A2 design methodology, which of the following most accurately describes the last step?

List of the apps used by the playbook.

List of the actions of the playbook design.

List of the outputs of the playbook design.

List of the data needed to run the playbook.

 Loading...

24. 1.Configuring Phantom search to use an external Splunk server provides which of the following benefits?

The ability to run more complex reports on Phantom activities.

The ability to ingest Splunk notable events into Phantom.

The ability to automate Splunk searches within Phantom.

The ability to display results as Splunk dashboards within Phantom.

 Loading...

25. What is the main purpose of using a customized workbook?

Workbooks automatically implement a customized processing of events using Python code.

Workbooks guide user activity and coordination during event analysis and case operations.

Workbooks apply service level agreements (SLAs) to containers and monitor completion status on the ROI dashboard.

Workbooks may not be customized; only default workbooks are permitted within Phantom.

 Loading...

26. The SOAR server has been configured to use an external Splunk search head for search and searching on SOAR works; however, the search results don't include content that was being returned by search before configuring external search.

Which of the following could be the problem?

The existing content indexes on the SOAR server need to be re-indexed to migrate them to Splunk.

The user configured on the SOAR side with Phantomsearch capability is not enabled on Splunk.

The remote Splunk search head is currently offline.

Content that existed before configuring external search must be backed up on SOAR and restored on the Splunk search head.

 Loading...

27. Which is the primary system requirement that should be increased with heavy usage of the file vault?

Amount of memory.

Number of processors.

Amount of storage.

Bandwidth of network.

 Loading...

28. What metrics can be seen from the System Health Display? (select all that apply)

Playbook Usage

Memory Usage

Disk Usage

Load Average

 Loading...

29. Which of the following are tabs of an asset configuration?

Asset Name, Asset IP, Asset URL, Asset Nickname

Tags, Asset Name, Asset Date, Asset Order

App Name, App Order, App Expiry, App Version

Asset Info, Asset Settings, Approval Settings, Access Control

 Loading...

30. When assigning an input parameter to an action while building a playbook, a user notices the artifact value they are looking for does not appear in the auto-populated list.

How is it possible to enter the unlisted artifact value?

Type the CEF datapath in manually.

Delete and recreate the artifact.

Edit the artifact to enable the List as Parameter option for the CEF value.

Edit the container to allow CEF parameters.

 Loading...

Page 4 of 4

31. On the Splunk search head, when configuring the app to search SOAR searchable content, what are the two requirements to complete the app setup?

User accounts and universal forwarder.

User accounts and an HTTP Event Collector token.

User accounts and REST AP

User accounts and syslog.

 Loading...

32. Which of the following roles is appropriate for a Splunk SOAR account that will only be used to execute automated tasks?

Non-Human

Automation

Automation Engineer

Service Account

 Loading...

33. What are the differences between cases and events?

Case: potential threats. Events: identified as a specific kind of problem and need a structured approach.

Cases: only include high-level incident artifacts. Events: only include low-level incident artifacts.

Cases: contain a collection of containers. Events: contain potential threats.

Cases: incidents with a known violation and a plan for correction. Events: occurrences in the system that may require a response.

 Loading...

 Loading...