SPLK-2003 Practice Exam Questions and Answers

A.  

Use Django queries; use curl to create a container and add artifacts to it; remove temporary lists.

B.  

Use Django queries; use Docker to create a container and add artifacts to it; remove temporary lists.

C.  

Use Django queries; use curl to create a container and add artifacts to it; add action blocks.

D.  

Use SQL queries; use curl to create a container and add artifacts to it; remove temporary lists.

A.  

Splunk Index

B.  

Case

C.  

Container

D.  

Log file

A.  

Any of the integrated Splunk/Phantom Apps

B.  

Splunk App for Phantom Reporting.

C.  

Splunk App for Phantom.

D.  

Phantom App for Splunk.

A.  

Embedded Splunk search engine.

B.  

Embedded Phantom search engine.

C.  

Embedded Elastic search engine.

D.  

Embedded Django search engine.

A.  

Notes

B.  

Actions

C.  

Service level agreement (SLA) expiration

D.  

Playbooks

A.  

On the command line enter: rode sudo python ibackup.pyc --setup, then audo phenv python ibackup.pyc --backup.

B.  

On the command line enter: sudo phenv python ibackup.pyc --backup —backup-type full, then sudo phenv python ibackup.pyc --setup.

C.  

Within the UI: Select from the main menu Administration > System Health > Backup.

D.  

Within the UI: Select from the main menu Administration > Product Settings > Backup.

A.  

Null IP addresses

B.  

Non-null IP addresses

C.  

Non-null destinationAddresses

D.  

Null values

A.  

A user can upload the output from a detonate action to the the files tab for further investigation.

B.  

Files tab items and artifacts are the only data sources that can populate active cases.

C.  

Files tab items cannot be added to investigations. Instead, add them to action blocks.

D.  

Phantom memory requirements remain static, regardless of Files tab usage.