SPLK-2003無料問題集「Splunk Phantom Certified Admin」

質問 1

What is enabled if the Logging option for a playbook's settings is enabled?

（A）The playbook will write detailed execution information into the spawn.log.

（B）More detailed logging information Is available in the Investigation page.

（C）More detailed information is available in the debug window.

（D）All modifications to the playbook will be written to the audit log.

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 2

What is the main purpose of using a customized workbook?

（A）Workbooks apply service level agreements (SLAs) to containers and monitor completion status on the ROI dashboard.

（B）Workbooks may not be customized; only default workbooks are permitted within Phantom.

（C）Workbooks automatically implement a customized processing of events using Python code.

（D）Workbooks guide user activity and coordination during event analysis and case operations.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 3

A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would permit which of the following data to pass forward to the next block?

（A）Non-null destinationAddresses

（B）Non-null IP addresses

（C）Null values

（D）Null IP addresses

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 4

What is the primary objective of using the I2A2 playbook design methodology?

（A）To create detailed playbooks.

（B）To create playbooks that customers will not edit.

（C）To meet customer requirements using a single playbook.

（D）To create simple, reusable, modular playbooks.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 5

Which of the following is the complete list of the types of backups that are supported by Phantom?

（A）Full, delta, and incremental backups.

（B）Full backups.

（C）Full and incremental backups.

（D）Full and delta backups.

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 6

Under Asset Ingestion Settings, how many labels must be applied when configuring an asset?

（A）One.

（B）One or more.

（C）Zero or more.

（D）Labels are not configured under Asset Ingestion Settings.

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 7

Some of the playbooks on the Phantom server should only be executed by members of the admin role. How can this rule be applied?

（A）Add a tag with restricted access to the restricted playbooks.

（B）Make sure the Execute Playbook capability is removed from al roles except admin.

（C）Place restricted playbooks in a second source repository that has restricted access.

（D）Add a filter block to al restricted playbooks that Titters for runRole - "Admin''.

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 8

When assigning an input parameter to an action while building a playbook, a user notices the artifact value they are looking for does not appear in the auto-populated list.
How is it possible to enter the unlisted artifact value?

（A）Edit the artifact to enable the List as Parameter option for the CEF value.

（B）Delete and recreate the artifact.

（C）Edit the container to allow CEF parameters.

（D）Type the CEF datapath in manually.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 9

When configuring a Splunk asset for Phantom to connect to a SplunkC loud instance, the user discovers that they need to be able to run two different on_poll searches. How is this possible

（A）Install a second Splunk app and configure the query in the second app.

（B）Configure the second query in the Phantom app for Splunk.

（C）Configure a second Splunk asset with the second query.

（D）Enter the two queries in the asset as comma separated values.

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 10

What does a user need to do to have a container with an event from Splunk use context-aware actions designed for notable events?

（A）Rename the event_id field from the notable event to splunkNotableEventld.

（B）Include the event_id field in the search results and add a CEF definition to Phantom for event_id, datatype splunk notable event id.

（C）Add a custom field to the container named event_id and set the custom field's data type to splunk notable event id.

（D）Include the notable event's event_id field and set the artifacts label to aplunk notable event id.

正解：B 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

SPLK-2003 無料問題集「Splunk Phantom Certified Admin」

弊社を連絡する

関連リンク

トップ試験