Splunk Phantom Certified Admin - SPLK-2003 Exam Practice Test

Question 1

How does a user determine which app actions are available?

A. Search the Apps category in the global search field.

B. Add an action block to a playbook canvas area.

C. From the Apps menu, click the supported actions dropdown for each app.

D. In the visual playbook editor, click Active and click the Available App Actions dropdown.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

Which Splunk search command is used to send a notable event to SOAR?

A. param.phantom

B. cim_modactions

C. sendtophantom

D. sendevent

Correct Answer: C

Question 3

Which visual playbook editor block is used to assemble commands and data into a valid Splunk search within a SOAR playbook?

A. A filter block.

B. A format block.

C. A prompt block.

D. An action block.

Correct Answer: D

Question 4

The SOAR server has been configured to use an external Splunk search head for search and searching on SOAR works; however, the search results don't include content that was being returned by search before configuring external search. Which of the following could be the problem?

A. The remote Splunk search head is currently offline.

B. Content that existed before configuring external search must be backed up on SOAR and restored on the Splunk search head.

C. The existing content indexes on the SOAR server need to be re-indexed to migrate them to Splunk.

D. The user configured on the SOAR side with Phantomsearch capability is not enabled on Splunk.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

What is the primary objective of using the I2A2 playbook design methodology?

A. To create playbooks that customers will not edit.

B. To meet customer requirements using a single playbook.

C. To create simple, reusable, modular playbooks.

D. To create detailed playbooks.

Correct Answer: C

Question 6

Is it possible to import external Python libraries such as the time module?

A. Yes, in the global block.

B. Yes. from a drop down menu.

C. No.

D. No, but this can be changed by setting the proper permissions.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

How can an individual asset action be manually started?

A. By executing a playbook in the Playbooks section.

B. With the > asset button in the asset configuration section.

C. With the > action button in the analyst queue page.

D. With the > action button in the Investigation page.

Correct Answer: D

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Splunk Phantom Certified Admin - SPLK-2003 Exam Practice Test

Latest Update

Useful Links

Contact Us