SPLK-2003 無料問題集「Splunk Phantom Certified Admin」

（A）Files tab items and artifacts are the only data sources that can populate active cases.

（B）A user can upload the output from a detonate action to the the files tab for further investigation.

（C）Phantom memory requirements remain static, regardless of Files tab usage.

（D）Files tab items cannot be added to investigations. Instead, add them to action blocks.

（A）Reset DECIDED to reset playbook environments back to at-start conditions.

（B）View a single column of status for SOAR processes. For metrics, click Details.

（C）Create a temporary, edited version of a process and test the results.

（D）Partially rewind processes, which is useful for debugging.

（A）One.

（B）One or more.

（C）Zero or more.

（D）Labels are not configured under Asset Ingestion Settings.

（A）1

（B）*

（C）0

（D）Default

（A）Low, Medium, Critical

（B）New, Open, Resolved

（C）New, In Progress, Closed

（D）Low, Medium, High

（A）phantom.print ()

（B）phantom.debug()

（C）phantom.exception()

（D）phantom.assert()

（A）To create detailed playbooks.

（B）To create playbooks that customers will not edit.

（C）To meet customer requirements using a single playbook.

（D）To create simple, reusable, modular playbooks.

（A）Change the tenant permissions.

（B）Select the associated tenant artifacts.

（C）Set default tenant base address.

（D）Configure the default tenant.

（A）Non-null destinationAddresses

（B）Non-null IP addresses

（C）Null values

（D）Null IP addresses

（A）Full, delta, and incremental backups.

（B）Full backups.

（C）Full and incremental backups.

（D）Full and delta backups.