Question 1

After a playbook has run, where are the results stored?

Options :

A : Splunk Index

B : Case

C : Container

D : Log file

Answer: C

Question 2

When is using decision blocks most useful?

Options :

A : When selecting one (or zero) possible paths in the playbook.

B : When processing different data in parallel.

C : When evaluating complex, multi-value results or artifacts.

D : When modifying downstream data hi one or more paths in the playbook.

Answer: A

Question 3

When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible

Options :

A : Enter the two queries in the asset as comma separated values.

B : Configure the second query in the Phantom app for Splunk.

C : Install a second Splunk app and configure the query in the second app.

D : Configure a second Splunk asset with the second query.

Answer: A

Question 4

Which Phantom API command is used to create a custom list?

Options :

A : phantom.add_list()

B : phantom.create_list()

C : phantom.include_list()

D : phantom.new_list()

Answer: B

Question 5

Which of the following roles is appropriate for a Splunk SOAR account that will only be used to execute automated tasks?

Options :

A : Non-Human

B : Automation

C : Automation Engineer

D : Service Account

Answer: B

Free SPLK-2003 Mock Exam – Practice Online Confidently

Buying Options: