[2023年03月] 検証済みSplunk SPLK-2003リアル豪華お試しセット試験問題集でPDF
SPLK-2003問題集PDF最新 [2023年最新] 究極の学習ガイド
質問 36
A user has written a playbook that calls three other playbooks, one after the other. The user notices that the second playbook starts executing before the first one completes. What is the cause of this behavior?
- A. Synchronous execution has not been configured.
- B. Incorrect Join configuration on the second playbook.
- C. The first playbook is performing poorly.
- D. The steep option for the second playbook is not set to a long enough interval.
正解: B
質問 37
When working with complex datapaths, which operator is used to access a sub-element inside another element?
- A. .(dot)
- B. !(pipe)
- C. :(colon)
- D. *(asterisk)
正解: B
質問 38
A customer wants to design a modular and reusable set of playbooks that all communicate with each other.
Which of the following is a best practice for data sharing across playbooks?
- A. Use the Handle method to pass data directly between playbooks.
- B. Create artifacts using one playbook and collect those artifacts in another playbook.
- C. Use the py-postgresq1 module to directly save the data in the Postgres database.
- D. Cal the child playbooks getter function.
正解: C
質問 39
Which is the primary system requirement that should be increased with heavy usage of the file vault?
- A. Number of processors.
- B. Bandwidth of network.
- C. Amount of memory.
- D. Amount of storage.
正解: D
質問 40
When analyzing events a working on a case, significant items can be marked as evidence. Where can ail of a case's evidence items be viewed together?
- A. At the bottom of the Investigation page widget panel.
- B. Workbook page Evidence tab.
- C. Investigation page Evidence tab.
- D. Evidence report.
正解: C
質問 41
Which app allows a user to run Splunk queries from within Phantom?
- A. Phantom App for Splunk.
- B. The Integrated Splunk/Phantom app.
- C. Splunk App for Phantom Reporting.
- D. Splunk App for Phantom?
正解: D
質問 42
Which of the following expressions will output debug information to the debug window in the Visual Playbook Editor?
- A. phantom.exception()
- B. phantom.assert()
- C. phantom.print ()
- D. phantom.debug()
正解: B
質問 43
How can the debug log for a playbook execution be viewed?
- A. Open the playbook in the Visual Playbook Editor, and select Debug Logs in Settings.
- B. On the Investigation page, select Debug Log from the playbook's action menu in the Recent Activity panel.
- C. Click Expand Scope m the debug window.
- D. In Administration > System Health > Playbook Run History, select the playbook execution entry, then select Log.
正解: C
質問 44
What are indicators?
- A. Action result items that determine the flow of execution in a playbook.
- B. Artifact values with special security significance.
- C. Action results that may appear in multiple containers.
- D. Artifact values that can appear in multiple containers.
正解: D
質問 45
What do assets provide for app functionality?
- A. Assets provide Python code, REST API, and other capabilities needed to run actions.
- B. Assets provide location, credentials, and other parameters needed to run actions.
- C. Assets provide hostnames, passwords, and other artifacts needed to run actions.
- D. Assets provide firewall, network, and data sources needed to run actions.
正解: B
質問 46
Which of the following can be configured in the ROl Settings?
- A. Analyst hours per month.
- B. Number of full time employees (FTEs).
- C. Annual analyst salary.
- D. Time lost.
正解: C
質問 47
What does a user need to do to have a container with an event from Splunk use context-aware actions designed for notable events?
- A. Include the event_id field in the search results and add a CEF definition to Phantom for event_id, datatype splunk notable event id.
- B. Rename the event_id field from the notable event to splunkNotableEventld.
- C. Include the notable event's event_id field and set the artifacts label to aplunk notable event id.
- D. Add a custom field to the container named event_id and set the custom field's data type to splunk notable event id.
正解: D
質問 48
Seventy can be set during ingestion and later changed manually. What other mechanism can change the severity or a container?
- A. Service level agreement (SLA) expiration
- B. Actions
- C. Playbooks
- D. Notes
正解: B
質問 49
Which of the following applies to filter blocks?
- A. Can be used to select data for use by other blocks.
- B. Can select assets by tenant, approver, or app.
- C. Can select which blocks have access to container data.
- D. Can select containers by seventy or status.
正解: C
質問 50
Which Phantom VPE Nock S used to add information to custom lists?
- A. Action blocks
- B. Filter blocks
- C. Decision blocks
- D. API blocks
正解: D
質問 51
A user wants to use their Splunk Cloud instance as the external Splunk instance for Phantom. What ports need to be opened on the Splunk Cloud instance to facilitate this? Assume default ports are in use.
- A. TCP 80 and TCP 443.
- B. TCP 8080 and TCP 8191.
- C. TCP 8088 and TCP 8099.
- D. Splunk Cloud is not supported.
正解: B
質問 52
What is the default embedded search engine used by Phantom?
- A. Embedded Splunk search engine.
- B. Embedded Phantom search engine.
- C. Embedded Elastic search engine.
- D. Embedded Django search engine.
正解: C
質問 53
Some of the playbooks on the Phantom server should only be executed by members of the admin role. How can this rule be applied?
- A. Place restricted playbooks in a second source repository that has restricted access.
- B. Make sure the Execute Playbook capability is removed from al roles except admin.
- C. Add a tag with restricted access to the restricted playbooks.
- D. Add a filter block to al restricted playbooks that Titters for runRole - "Admin''.
正解: D
質問 54
Which of the following describes the use of labels m Phantom?
- A. Labels control the default seventy, ownership, and sensitivity for the container.
- B. Labels determine which playbook(s) are executed when a container is created.
- C. Labels control which apps are allowed to execute actions on the container.
- D. Labels determine the service level agreement (SLA) for a container.
正解: A
質問 55
......
あなたを合格させるSplunk試験でSPLK-2003試験問題集：https://www.jpntest.com/shiken/SPLK-2003-mondaishu