SPLK-2003 Practice Questions

A.  

By restarting the playbook daemon.

B.  

On the System Health page.

C.  

In Administration > Server Settings.

D.  

By restarting the automation service.

A.  

To create detailed playbooks.

B.  

To create playbooks that customers will not edit.

C.  

To meet customer requirements using a single playbook.

D.  

To create simple, reusable, modular playbooks.

A.  

Copy/paste the attachment into a note.

B.  

Add a link to the file in a new artifact.

C.  

Use the Files tab on the Investigation page to upload the attachment.

D.  

Use the Upload action of the Secure Store app to store the file in the database.

A.  

Install the Phantom RPM in a GNU Cygwin implementation.

B.  

Run the Phantom OVA as a cloud instance.

C.  

Install the Phantom RPM file in Windows Subsystem for Linux (WSL).

D.  

Run the Phantom OVA as a virtual machine.

A.  

Embedded Splunk search engine.

B.  

Embedded SOAR search engine.

C.  

Embedded Django search engine.

D.  

Embedded Elastic search engine.

A.  

To generate arrays for input into other functions.

B.  

To generate HTML or CSS content for output in email messages, user prompts, or comments.

C.  

To generate string parameters for automated action blocks.

D.  

To create text strings that merge state text with dynamic values for input or output.

A.  

Type the CEF datapath in manually.

B.  

Delete and recreate the artifact.

C.  

Edit the artifact to enable the List as Parameter option for the CEF value.

D.  

Edit the container to allow CEF parameters.

A.  

GitHub and Splunkbase.

B.  

SOAR Community and GitHub.

C.  

Splunkbase and SOAR Community.

D.  

Splunk Answers and Splunkbase.

A.  

The child playbook does not have access to the parent playbook's container or action result data.

B.  

The child playbook does not have access to the parent playbook's container, but to the parent's action result data.

C.  

The child playbook has access to the parent playbook's container and the parent's action result data.

D.  

The child playbook has access to the parent playbook's container, but not to the parent's action result data.

A.  

Enter the two queries in the asset as comma separated values.

B.  

Configure the second query in the Phantom app for Splunk.

C.  

Install a second Splunk app and configure the query in the second app.

D.  

Configure a second Splunk asset with the second query.