Question 1

When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible

Options :

A : Enter the two queries in the asset as comma separated values.

B : Configure the second query in the Phantom app for Splunk.

C : Install a second Splunk app and configure the query in the second app.

D : Configure a second Splunk asset with the second query.

Answer: A

Question 2

Configuring SOAR search to use an external Splunk server provides which of the following benefits?

Options :

A : The ability to run more complex reports on SOAR activities.

B : The ability to ingest Splunk notable events into SOAR.

C : The ability to automate Splunk searches within SOAR.

D : The ability to display results as Splunk dashboards within SOAR.

Answer: C

Question 3

Is it possible to import external Python libraries such as the time module?

Options :

A : No

B : No, but this can be changed by setting the proper permissions.

C : Yes, in the global block.

D : Yes. from a drop-down menu.

Answer: C

Question 4

After a playbook has run, where are the results stored?

Options :

A : Splunk Index

B : Case

C : Container

D : Log file

Answer: C

Question 5

Phantom supports multiple user authentication methods such as LDAP and SAML2. What other user authentication method is supported?

Options :

A : SAML3

B : PIV/CAC

C : Biometrics

D : OpenID

Answer: B

Free SPLK-2003 Mock Exam – Practice Online Confidently

Buying Options: