Download Splunk SOAR Certified Automation Developer.VCEPlus.SPLK-2003.2023-05-22.1e.58q.vcex

Configuring Phantom search to use an external Splunk server provides which of the following benefits?

• A: The ability to run more complex reports on Phantom activities.
• B: The ability to ingest Splunk notable events into Phantom.
• C: The ability to automate Splunk searches within Phantom.
• D: The ability to display results as Splunk dashboards within Phantom.

Correct Answer: C

Within the 12A2 design methodology, which of the following most accurately describes the last step?

• A: List of the apps used by the playbook.
• B: List of the actions of the playbook design.
• C: List of the outputs of the playbook design.
• D: List of the data needed to run the playbook.

Correct Answer: D

Which of the following are the steps required to complete a full backup of a Splunk Phantom deployment' Assume the commands are executed from /opt/phantom/bin and that no other backups have been made.

• A: On the command line enter: rode sudo python ibackup.pyc --setup, then audo phenv python ibackup.pyc --backup.
• B: On the command line enter: sudo phenv python ibackup.pyc --backup —backup-type full, then sudo phenv python ibackup.pyc --setup.
• C: Within the UI: Select from the main menu Administration > System Health > Backup.
• D: Within the UI: Select from the main menu Administration > Product Settings > Backup.

Correct Answer: B

An active playbook can be configured to operate on all containers that share which attribute?

• A: Artifact
• B: Label
• C: Tag
• D: Severity

Correct Answer: B

Which of the following applies to filter blocks?

• A: Can select which blocks have access to container data.
• B: Can select assets by tenant, approver, or app.
• C: Can be used to select data for use by other blocks.
• D: Can select containers by seventy or status.

Correct Answer: A

A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes. What is the cause of this behavior?

• A: Incorrect Join configuration on the second playbook.
• B: The first playbook is performing poorly.
• C: The steep option for the second playbook is not set to a long enough interval.
• D: Synchronous execution has not been configured.

Correct Answer: A

A customer wants to design a modular and reusable set of playbooks that all communicate with each other. Which of the following is a best practice for data sharing across playbooks?

• A: Use the py-postgresq1 module to directly save the data in the Postgres database.
• B: Cal the child playbooks getter function.
• C: Create artifacts using one playbook and collect those artifacts in another playbook.
• D: Use the Handle method to pass data directly between playbooks.

Correct Answer: A

Which of the following are examples of things commonly done with the Phantom REST APP

• A: Use Django queries; use curl to create a container and add artifacts to it; remove temporary lists.
• B: Use Django queries; use Docker to create a container and add artifacts to it; remove temporary lists.
• C: Use Django queries; use curl to create a container and add artifacts to it; add action blocks.
• D: Use SQL queries; use curl to create a container and add artifacts to it; remove temporary lists.

Correct Answer: C

Which of the following are the default ports that must be configured on Splunk to allow connections from Phantom?

• A: SplunkWeb (8088), SplunkD (8089), HTTP Collector (8000)
• B: SplunkWeb (8089), SplunkD (8088), HTTP Collector (8000)
• C: SplunkWeb (8421), SplunkD (8061), HTTP Collector (8798)
• D: SplunkWeb (8000), SplunkD (8089), HTTP Collector (8088)

Correct Answer: D

Without customizing container status within Phantom, what are the three types of status for a container?

• A: New, In Progress, Closed
• B: Low, Medium, High
• C: Mew, Open, Resolved
• D: Low, Medium, Critical

Correct Answer: A