Splunk SPLK-2003 Exam Questions - Real Practice Questions for Guaranteed Success

Question 1

Some of the playbooks on the Phantom server should only be executed by members of the admin role. How can this rule be applied?

AAdd a filter block to al restricted playbooks that Titters for runRole - 'Admin''.

BAdd a tag with restricted access to the restricted playbooks.

CMake sure the Execute Playbook capability is removed from al roles except admin.

DPlace restricted playbooks in a second source repository that has restricted access.

Correct : A

Options Selected by Other Users:

Mark Question:

Start a Discussions

Submit Your Answer:

AAdd a filter block to al restricted playbooks that Titters for runRole - 'Admin''.

BAdd a tag with restricted access to the restricted playbooks.

CMake sure the Execute Playbook capability is removed from al roles except admin.

DPlace restricted playbooks in a second source repository that has restricted access.

0 / 1500

Question 2

What values can be applied when creating Custom CEF field?

AName

BName, Data Type

CName, Value

DName, Data Type, Severity

Correct : D

Options Selected by Other Users:

Mark Question:

Start a Discussions

Submit Your Answer:

AName

BName, Data Type

CName, Value

DName, Data Type, Severity

0 / 1500

Question 3

What is enabled if the Logging option for a playbook's settings is enabled?

AMore detailed logging information Is available m the Investigation page.

BAll modifications to the playbook will be written to the audit log.

CMore detailed information is available in the debug window.

DThe playbook will write detailed execution information into the spawn.log.

Correct : D

Options Selected by Other Users:

Mark Question:

Start a Discussions

Submit Your Answer:

AMore detailed logging information Is available m the Investigation page.

BAll modifications to the playbook will be written to the audit log.

CMore detailed information is available in the debug window.

DThe playbook will write detailed execution information into the spawn.log.

0 / 1500

Question 4

Is it possible to import external Python libraries such as the time module?

ANo.

BNo, but this can be changed by setting the proper permissions.

CYes, in the global block.

DYes. from a drop down menu.

Correct : C

Options Selected by Other Users:

Mark Question:

Start a Discussions

Submit Your Answer:

ANo.

BNo, but this can be changed by setting the proper permissions.

CYes, in the global block.

DYes. from a drop down menu.

0 / 1500

Question 5

Which of the following accurately describes the Files tab on the Investigate page?

AA user can upload the output from a detonate action to the the files tab for further investigation.

BFiles tab items and artifacts are the only data sources that can populate active cases.

CFiles tab items cannot be added to investigations. Instead, add them to action blocks.

DPhantom memory requirements remain static, regardless of Files tab usage.

Correct : D

Options Selected by Other Users:

Mark Question:

Start a Discussions

Submit Your Answer:

AA user can upload the output from a detonate action to the the files tab for further investigation.

BFiles tab items and artifacts are the only data sources that can populate active cases.

CFiles tab items cannot be added to investigations. Instead, add them to action blocks.

DPhantom memory requirements remain static, regardless of Files tab usage.

0 / 1500

Master Splunk SPLK-2003 Exam with Reliable Practice Questions

Options Selected by Other Users:

Options Selected by Other Users:

Options Selected by Other Users:

Options Selected by Other Users:

Options Selected by Other Users: