SPLK-2003 Practice Questions

A.  

Event Name and Artifact Names.

B.  

Event Name, Notes, Comments.

C.  

Event Name or I

D.  

A.  

Polling Interval

B.  

Tag

C.  

File format

D.  

Operating system

A.  

0

B.  

Default

C.  

1

D.  

*

A.  

Eliminates any need to use Python code.

B.  

The Visual Playbook Editor is the only way to generate user prompts.

C.  

Supports Python or Javascript.

D.  

Easier playbook maintenance.

A.  

phantom.add_list()

B.  

phantom.create_list()

C.  

phantom.include_list()

D.  

phantom.new_list()

A.  

Snapshot

B.  

Incremental

C.  

Partial

D.  

Differential

A.  

A container.

B.  

An artifact.

C.  

A comment.

D.  

A note.

A.  

Splunk App for Phantom

B.  

The Integrated Splunk/Phantom app.

C.  

Phantom App for Splunk.

D.  

Splunk App for Phantom Reporting.

A.  

Case: potential threats.

Events: identified as a specific kind of problem and need a structured approach.

B.  

Cases: only include high-level incident artifacts.

Events: only include low-level incident artifacts.

C.  

Cases: contain a collection of containers.

Events: contain potential threats.

D.  

Cases: incidents with a known violation and a plan for correction.

Events: occurrences in the system that may require a response.

A.  

To define a set of users who have access to a special label.

B.  

To define a set of users who have access to a restricted app.

C.  

To define a set of users who have access to an event's reports.

D.  

To define a set of users who have access to a sensitive tag.