Free Splunk SOAR Certified Automation Developer Exam SPLK-2003 Exam Practice Test

Configuring Phantom search to use an external Splunk server provides which of the following benefits?

• The ability to run more complex reports on Phantom activities.
• The ability to ingest Splunk notable events into Phantom.
• The ability to automate Splunk searches within Phantom.
• The ability to display results as Splunk dashboards within Phantom.

Which of the following accurately describes the Files tab on the Investigate page?

• A user can upload the output from a detonate action to the the files tab for further investigation.
• Files tab items and artifacts are the only data sources that can populate active cases.
• Files tab items cannot be added to investigations. Instead, add them to action blocks.
• Phantom memory requirements remain static, regardless of Files tab usage.

Which of the following is the complete list of the types of backups that are supported by Phantom?

• Full backups.
• Full, delta, and incremental backups.
• Full and incremental backups.
• Full and delta backups.

Which Phantom VPE Nock S used to add information to custom lists?

• Action blocks
• Filter blocks
• API blocks
• Decision blocks

After a successful POST to a Phantom REST endpoint to create a new object what result is returned?

• The new object ID.
• The new object name.
• The full CEF name.
• The PostGres UUID.

After a playbook has run, where are the results stored?

• Splunk Index
• Case
• Container
• Log file

Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?

• superuser, administrator
• phantomcreate. phantomedit
• phantomsearch, phantomdelete
• admin,user

Which of the following is a best practice for use of the global block?

• Execute code at the beginning of each run of the playbook.
• Declare outputs which will be selectable within playbook blocks.
• Import packages which will be used within the playbook.
• Execute custom code after each run of the playbook.

What do assets provide for app functionality?

• Assets provide location, credentials, and other parameters needed to run actions.
• Assets provide hostnames, passwords, and other artifacts needed to run actions.
• Assets provide Python code, REST API, and other capabilities needed to run actions.
• Assets provide firewall, network, and data sources needed to run actions.

Which of the following are examples of things commonly done with the Phantom REST APP

• Use Django queries; use curl to create a container and add artifacts to it; remove temporary lists.
• Use Django queries; use Docker to create a container and add artifacts to it; remove temporary lists.
• Use Django queries; use curl to create a container and add artifacts to it; add action blocks.
• Use SQL queries; use curl to create a container and add artifacts to it; remove temporary lists.