Free Splunk SOAR Certified Automation Developer Exam SPLK-2003 Exam Practice Test

Which Phantom VPE Nock S used to add information to custom lists?

• Action blocks
• Filter blocks
• API blocks
• Decision blocks

What do assets provide for app functionality?

• Assets provide location, credentials, and other parameters needed to run actions.
• Assets provide hostnames, passwords, and other artifacts needed to run actions.
• Assets provide Python code, REST API, and other capabilities needed to run actions.
• Assets provide firewall, network, and data sources needed to run actions.

Which of the following are examples of things commonly done with the Phantom REST APP

• Use Django queries; use curl to create a container and add artifacts to it; remove temporary lists.
• Use Django queries; use Docker to create a container and add artifacts to it; remove temporary lists.
• Use Django queries; use curl to create a container and add artifacts to it; add action blocks.
• Use SQL queries; use curl to create a container and add artifacts to it; remove temporary lists.

What are the differences between cases and events?

• Case: potential threats. Events: identified as a specific kind of problem and need a structured approach.
• Cases: only include high-level incident artifacts. Events: only include low-level incident artifacts.
• Cases: contain a collection of containers. Events: contain potential threats.
• Cases: incidents with a known violation and a plan for correction. Events: occurrences in the system that may require a response.

What are indicators?

• Action result items that determine the flow of execution in a playbook.
• Action results that may appear in multiple containers.
• Artifact values that can appear in multiple containers.
• Artifact values with special security significance.

Which app allows a user to send Splunk Enterprise Security notable events to Phantom?

• Any of the integrated Splunk/Phantom Apps
• Splunk App for Phantom Reporting.
• Splunk App for Phantom.
• Phantom App for Splunk.

What does a user need to do to have a container with an event from Splunk use context-aware actions designed for notable events?

• Include the notable event's event_id field and set the artifacts label to aplunk notable event id.
• Rename the event_id field from the notable event to splunkNotableEventld.
• Include the event_id field in the search results and add a CEF definition to Phantom for event_id, datatype splunk notable event id.
• Add a custom field to the container named event_id and set the custom field's data type to splunk notable event id.

Which of the following supported approaches enables Phantom to run on a Windows server?

• Install the Phantom RPM in a GNU Cygwin implementation.
• Run the Phantom OVA as a cloud instance.
• Install the Phantom RPM file in Windows Subsystem for Linux (WSL).
• Run the Phantom OVA as a virtual machine.

Which of the following describes the use of labels m Phantom?

• Labels determine the service level agreement (SLA) for a container.
• Labels control the default seventy, ownership, and sensitivity for the container.
• Labels control which apps are allowed to execute actions on the container.
• Labels determine which playbook(s) are executed when a container is created.

Which of the following is a best practice for use of the global block?

• Execute code at the beginning of each run of the playbook.
• Declare outputs which will be selectable within playbook blocks.
• Import packages which will be used within the playbook.
• Execute custom code after each run of the playbook.