Updated Nov-2023 Exam SPLK-2003 Dumps - Pass Your Certification Exam [Q15-Q34] : Top Exam Collection : http://blog.topexamcollection.com

NR. 15 Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?

superuser, administrator

phantomcreate. phantomedit

phantomsearch, phantomdelete

admin,user

NR. 16 Which of the following can be configured in the ROl Settings?

Analyst hours per month.

Time lost.

Number of full time employees (FTEs).

Annual analyst salary.

NR. 17 Which of the following applies to filter blocks?

Can select which blocks have access to container data.

Can select assets by tenant, approver, or app.

Can be used to select data for use by other blocks.

Can select containers by seventy or status.

NR. 18 Which of the following is a best practice for use of the global block?

Execute code at the beginning of each run of the playbook.

Declare outputs which will be selectable within playbook blocks.

Import packages which will be used within the playbook.

Execute custom code after each run of the playbook.

NR. 19 Which of the following are the default ports that must be configured on Splunk to allow connections from Phantom?

SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000)

SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000)

SplunkWeb (8421), SplunkD (8061), HTTP Collector (8798)

SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)

NR. 20 Which Phantom VPE Nock S used to add information to custom lists?

Action blocks

Filter blocks

API blocks

Decision blocks

NR. 21 What do assets provide for app functionality?

Assets provide location, credentials, and other parameters needed to run actions.

Assets provide hostnames, passwords, and other artifacts needed to run actions.

Assets provide Python code, REST API, and other capabilities needed to run actions.

Assets provide firewall, network, and data sources needed to run actions.

NR. 22 Which of the following is a best practice for use of the global block?

Execute code at the beginning of each run of the playbook.

Declare outputs which will be selectable within playbook blocks.

Import packages which will be used within the playbook.

Execute custom code after each run of the playbook.

NR. 23 Which Phantom VPE Nock S used to add information to custom lists?

Action blocks

Filter blocks

API blocks

Decision blocks

NR. 24 A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?

Null IP addresses

Non-null IP addresses

Non-null destinationAddresses

Null values

NR. 25 Which of the following describes the use of labels m Phantom?

Labels determine the service level agreement (SLA) for a container.

Labels control the default seventy, ownership, and sensitivity for the container.

Labels control which apps are allowed to execute actions on the container.

Labels determine which playbook(s) are executed when a container is created.

NR. 26 When working with complex datapaths, which operator is used to access a sub-element inside another element?

!(pipe)

*(asterisk)

:(colon)

.(dot)

NR. 27 Without customizing container status within Phantom, what are the three types of status for a container?

New, In Progress, Closed

Low, Medium, High

Mew, Open, Resolved

Low, Medium, Critical

NR. 28 A user wants to use their Splunk Cloud instance as the external Splunk instance for Phantom. What ports need to be opened on the Splunk Cloud instance to facilitate this? Assume default ports are in use.

TCP 8088 and TCP 8099.

TCP 80 and TCP 443.

Splunk Cloud is not supported.

TCP 8080 and TCP 8191.

NR. 29 In this image, which container fields are searched for the text “Malware”?

Event Name and Artifact Names.

Event Name, Notes, Comments.

Event Name or ID.

NR. 30 Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment’ Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.

On the command line enter: rode sudo python ibackup.pyc –setup, then audo phenv python ibackup.pyc
–backup.

On the command line enter: sudo phenv python ibackup.pyc –backup -backup-type full, then sudo phenv python ibackup.pyc –setup.

Within the UI: Select from the main menu Administration > System Health > Backup.

Within the UI: Select from the main menu Administration > Product Settings > Backup.

NR. 31 Which of the following are examples of things commonly done with the Phantom REST APP

Use Django queries; use curl to create a container and add artifacts to it; remove temporary lists.

Use Django queries; use Docker to create a container and add artifacts to it; remove temporary lists.

Use Django queries; use curl to create a container and add artifacts to it; add action blocks.

Use SQL queries; use curl to create a container and add artifacts to it; remove temporary lists.

NR. 32 When working with complex data paths, which operator is used to access a sub-element inside another element?

!(pipe)

*(asterisk)

:(colon)

.(dot)

NR. 33 Which of the following is a step when configuring event forwarding from Splunk to Phantom?

Map CIM to CEF fields.

Create a Splunk alert that uses the event_forward.py script to send events to Phantom.

Map CEF to CIM fields.

Create a saved search that generates the JSON for the new container on Phantom.

NR. 34 Splunk user account(s) with which roles must be created to configure Phantom with an external Splunk Enterprise instance?

superuser, administrator

phantomcreate. phantomedit

phantomsearch, phantomdelete

admin,user